Network anti-mapping method and device and related equipment

Abstract

The invention discloses a network anti-mapping method and device and related equipment, and the method comprises the steps: carrying out the content detection of a message transmitted in a target network, and recognizing and determining a topology detection message containing a network topology detection behavior; based on target information of the topology detection message, a target virtual node is matched in a specified virtual topology structure, and the target information comprises a target address and a TTL value; and generating and returning a response message based on the target virtual node, wherein the response message comprises a forged source IP address of the target virtual node. According to the method, the virtual topological nodes are dynamically matched and the forged response message is generated, so that a real network structure is effectively hidden, and the flexibility and the security of surveying and mapping resistance are enhanced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network anti-mapping method, device and related equipment. Background Art

[0002] Critical information infrastructure (CII) plays a vital role in modern society. However, with the development of network technology, cyber attackers use cyberspace mapping technology to attempt to steal network topology information of CII to launch attacks, threatening the network security of CII. However, the existing network anti-mapping technology has limited protection capabilities. When dealing with complex, low-frequency and multi-mode topology detection behaviors, there are problems such as insufficient recognition accuracy and inflexible response. Summary of the invention

[0003] The embodiments of the present application provide a method, apparatus and related equipment for network anti-mapping, which effectively hides the real network structure by dynamically matching virtual topology nodes and generating forged response messages, thereby enhancing the flexibility and security of anti-mapping. The above technical solutions are as follows:

[0004] In a first aspect, an embodiment of the present application provides a network anti-mapping method, the method comprising:

[0005] Perform content detection on the messages transmitted in the target network, identify and determine the topology detection messages containing network topology detection behavior;

[0006] Based on the target information of the topology detection message, match the target virtual node in the specified virtual topology structure, wherein the target information includes the target address and TTL (Time to Live) value;

[0007] A response message is generated and returned based on the target virtual node, wherein the response message includes the forged source IP address of the target virtual node.

[0008] In a possible implementation, the above-mentioned performing content detection on the message transmitted in the target network to identify and determine the topology detection message containing the network topology detection behavior includes:

[0009] Check whether the source IP address of the message transmitted in the target network belongs to the whitelist;

[0010] If it is confirmed that the source IP address of the above-mentioned message does not belong to the whitelist, deep packet inspection is performed on the above-mentioned message. Based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, the topology detection message containing the network topology detection behavior is identified and determined; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0011] In a possible implementation, the above-mentioned topology detection message includes a topology detection message based on the ICMP (Internet Control Message Protocol) protocol, a topology detection message based on the UDP (User Datagram Protocol) protocol, and a topology detection message based on the TCP (Transmission Control Protocol) protocol.

[0012] In a possible implementation, the ICMP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0013] The data volume of the message is less than the preset data volume;

[0014] The TTL values ​​between packets with the same source IP address gradually increase;

[0015] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0016] In a possible implementation, the UDP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0017] The port number of the destination address of the message is greater than 1024;

[0018] The TTL values ​​between packets with the same source IP address gradually increase;

[0019] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0020] In a possible implementation, the TCP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0021] The message is a TCP SYN (Transmission Control Protocol Synchronize) data packet;

[0022] The port number of the destination address of the message is greater than the preset port number or belongs to the specified port number;

[0023] The TTL values ​​between packets with the same source IP address gradually increase;

[0024] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0025] In a possible implementation, matching the target virtual node in the specified virtual topology structure based on the target information of the topology detection message includes:

[0026] Matching associated virtual nodes in the virtual topology structure based on the target address of the topology detection message;

[0027] Confirm whether the TTL value of the topology detection message reaches the preset TTL value corresponding to the associated virtual node;

[0028] If yes, then the above associated virtual node is used as the target virtual node;

[0029] If not, the target virtual node is matched according to the TTL value of the topology detection message and the virtual topology structure.

[0030] In a possible implementation, the virtual topology structure is generated based on a network topology structure in a network topology structure library;

[0031] Before matching at least one target virtual node in the specified virtual topology structure, the method further includes:

[0032] Obtain network topology data for various network environment types;

[0033] A variety of network topology structures are generated based on the network topology data and the input configuration information, and stored in the network topology structure library.

[0034] In a possible implementation, the above-mentioned performing content detection on the message transmitted in the target network to identify and determine the topology detection message containing the network topology detection behavior includes:

[0035] Check whether the source IP address of the message transmitted in the target network belongs to the blacklist;

[0036] If it is confirmed that the source IP address of the message belongs to the blacklist, the message is determined to be the topology detection message.

[0037] In a possible implementation, after confirming that the source IP address of the message belongs to the blacklist, the following steps are performed:

[0038] Confirm whether the risk level of the source IP address of the above message in the above blacklist is higher than the risk threshold;

[0039] If yes, determining the message as the topology detection message;

[0040] If not, perform deep packet inspection on the above-mentioned message, and based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, identify and determine the topology detection message containing the network topology detection behavior; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0041] In a possible implementation manner, after the above-mentioned identification and determination of the topology detection message containing the network topology detection behavior, the method further includes:

[0042] Check whether the source IP address of the topology detection message is on the blacklist.

[0043] If not, the source IP address of the topology detection message is added to the blacklist and assigned an initial risk level, the initial risk level being lower than the risk threshold;

[0044] If so, the risk level of the topology detection message in the blacklist is updated based on a preset risk rule.

[0045] In a possible implementation, the method further includes:

[0046] Obtain network security intelligence data from multiple sources and record network traffic data of the above target networks;

[0047] Identify suspicious entities based on the above network security intelligence data and the above network traffic data;

[0048] The source IP address of the above suspicious subject is added to the blacklist. The risk level of the source IP address of the above suspicious subject is higher than the risk threshold.

[0049] In a possible implementation, the method further includes:

[0050] Using distributed detection nodes set in different network areas to perform topology detection tasks on the target network, and obtain a detection topology structure;

[0051] The above detection topology is compared with the above virtual topology to verify the effectiveness of the above target network anti-mapping.

[0052] In a second aspect, an embodiment of the present application provides a network anti-mapping device, the device comprising:

[0053] A detection module is used to perform content detection on messages transmitted in the target network, identify and determine topology detection messages containing network topology detection behavior;

[0054] A camouflage module, used to match a target virtual node in a specified virtual topology structure based on the target information of the topology detection message, wherein the target information includes a target address and a TTL value;

[0055] A response module is used to generate and return a response message based on the above-mentioned target virtual node, and the above-mentioned response message includes the forged source IP address of the above-mentioned target virtual node.

[0056] In a possible implementation, the detection module is specifically used to:

[0057] Check whether the source IP address of the message transmitted in the target network belongs to the whitelist;

[0058] If it is confirmed that the source IP address of the above-mentioned message does not belong to the whitelist, deep packet inspection is performed on the above-mentioned message. Based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, the topology detection message containing the network topology detection behavior is identified and determined; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0059] In a possible implementation, the topology detection message includes a topology detection message based on the ICMP protocol, a topology detection message based on the UDP protocol, and a topology detection message based on the TCP protocol.

[0060] In a possible implementation, the ICMP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0061] The data volume of the message is less than the preset data volume;

[0062] The TTL values ​​between packets with the same source IP address gradually increase;

[0063] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0064] In a possible implementation, the UDP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0065] The port number of the destination address of the message is greater than 1024;

[0066] The TTL values ​​between packets with the same source IP address gradually increase;

[0067] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0068] In a possible implementation, the TCP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0069] The message is a TCP SYN packet;

[0070] The port number of the destination address of the message is greater than the preset port number or belongs to the specified port number;

[0071] The TTL values ​​between packets with the same source IP address gradually increase;

[0072] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0073] In a possible implementation, the camouflage module is specifically used to:

[0074] Matching associated virtual nodes in the virtual topology structure based on the target address of the topology detection message;

[0075] Confirm whether the TTL value of the topology detection message reaches the preset TTL value corresponding to the associated virtual node;

[0076] If yes, then the above associated virtual node is used as the target virtual node;

[0077] If not, the target virtual node is matched according to the TTL value of the topology detection message and the virtual topology structure.

[0078] In a possible implementation, the virtual topology structure is generated based on a network topology structure in a network topology structure library;

[0079] The device also includes a generating module, which is specifically used for:

[0080] Obtain network topology data for various network environment types;

[0081] A variety of network topology structures are generated based on the network topology data and the input configuration information, and stored in the network topology structure library.

[0082] In a possible implementation, the detection module is specifically used to:

[0083] Check whether the source IP address of the message transmitted in the target network belongs to the blacklist;

[0084] If it is confirmed that the source IP address of the message belongs to the blacklist, the message is determined to be the topology detection message.

[0085] In a possible implementation, the detection module is further configured to:

[0086] Confirm whether the risk level of the source IP address of the above message in the above blacklist is higher than the risk threshold;

[0087] If yes, determining the message as the topology detection message;

[0088] If not, perform deep packet inspection on the above-mentioned message, and based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, identify and determine the topology detection message containing the network topology detection behavior; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0089] In a possible implementation, the device further includes a monitoring module, which is specifically configured to:

[0090] Check whether the source IP address of the topology detection message is on the blacklist.

[0091] If not, the source IP address of the topology detection message is added to the blacklist and assigned an initial risk level, the initial risk level being lower than the risk threshold;

[0092] If so, the risk level of the topology detection message in the blacklist is updated based on a preset risk rule.

[0093] In a possible implementation, the device further includes an audit module, which is specifically configured to:

[0094] Obtain network security intelligence data from multiple sources and record network traffic data of the above target networks;

[0095] Identify suspicious entities based on the above network security intelligence data and the above network traffic data;

[0096] The source IP address of the above suspicious subject is added to the blacklist. The risk level of the source IP address of the above suspicious subject is higher than the risk threshold.

[0097] In a possible implementation, the device further includes a verification module, which is specifically configured to:

[0098] Using distributed detection nodes set in different network areas to perform topology detection tasks on the target network, and obtain a detection topology structure;

[0099] The above detection topology is compared with the above virtual topology to verify the effectiveness of the above target network anti-mapping.

[0100] In a third aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores instructions, and the instructions are suitable for being loaded by a processor and executing the method provided by the first aspect of the embodiment of the present application or any possible implementation of the first aspect.

[0101] In a fourth aspect, an embodiment of the present application provides an electronic device, including: a processor and a memory;

[0102] The processor is connected to the memory;

[0103] The above-mentioned memory is used to store executable program code;

[0104] The processor runs the program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method provided by the first aspect of the embodiment of the present application or any possible implementation of the first aspect.

[0105] In one or more embodiments of the present application, by dynamically matching the target virtual node in the virtual topology structure and generating a forged response message, the detector cannot distinguish the real network structure and effectively hide the internal network topology. Using the target address and TTL value in the detection message, the response strategy can be flexibly adjusted to ensure that the returned forged information conforms to the detector's expected path and increase confusion. By dynamically generating forged response messages, the detector is prevented from obtaining network topology information through traditional scanning and detection methods, thereby improving the overall security protection capabilities of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0106] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0107] Figure 1 A schematic diagram of the architecture of a network anti-mapping system provided for an exemplary embodiment of the present application;

[0108] Figure 2 A flowchart of a network anti-mapping method provided by an exemplary embodiment of the present application;

[0109] Figure 3 A schematic diagram of a network topology structure provided for an exemplary embodiment of the present application;

[0110] Figure 4 A schematic diagram of a multi-source network tomography topology inference model provided for an exemplary embodiment of the present application;

[0111] Figure 5 A flowchart of another network anti-mapping method provided for an exemplary embodiment of the present application;

[0112] Figure 6 A flowchart of a verification process of a network anti-mapping method provided by an exemplary embodiment of the present application;

[0113] Figure 7 A flowchart of another network anti-mapping method provided for an exemplary embodiment of the present application;

[0114] Figure 8 A schematic diagram of the structure of a network anti-mapping device provided by an exemplary embodiment of the present application;

[0115] Fig. 9 A schematic structural diagram of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0116] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0117] In the description of the present application, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. In addition, in the description of the present application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0118] In the network anti-mapping needs of critical information infrastructure, encryption technology and network deception technology are two main defense methods. Encryption technology encrypts data transmitted over the network to ensure that the data is not illegally intercepted and parsed during transmission. It focuses on protecting the confidentiality of data and preventing attackers from obtaining sensitive information. However, although encryption technology can protect data content, it cannot completely prevent attackers from detecting network topology through other means. Network deception technology misleads and interferes with attackers by forging network topology, IP (Internet Protocol) addresses, ports, services and other information, making it difficult for them to obtain the real network situation. Network deception technology can capture the behavioral characteristics of attackers, consume the attacker's resources, and provide data support for subsequent attack tracing.

[0119] This scheme proposes a network anti-mapping method, which effectively hides the real network structure by dynamically matching virtual topology nodes and generating forged response messages. This scheme can not only respond to detection behaviors, but also dynamically adjust the selection and response strategy of virtual nodes according to the target address and TTL value in the detection message, providing more accurate defense and confusion effects, thereby further improving network security and privacy.

[0120] The present application is described in detail below with reference to specific embodiments.

[0121] Please refer to Figure 1 , Figure 1 A schematic diagram of the architecture of a network anti-mapping system provided for an exemplary embodiment of the present application. The network anti-mapping system analyzes the characteristics of the current typical internal network (intranet) of key information infrastructure equipment to generate a network topology structure that conforms to its intranet topology characteristics. On this basis, the mapping behavior of carrying out topology detection targeting the network topology structure is identified and discovered, and then the source IP address of the response message is modified and returned to the network detection subject, thereby realizing the hiding of the internal network topology information. At the same time, a distributed topology mapping platform is constructed to verify and evaluate the effect of hiding the topology information. Among them, the key information infrastructure is generally deployed in the internal network. In the scenario of network anti-mapping, the internal network is generally selected as the protection object. The embodiment of the present application takes the scenario of intranet anti-mapping as an example, but it is not restrictive. In some embodiments, the embodiment of the present application may also be suitable for other network environments.

[0122] like Figure 1 As shown, the network anti-mapping system can be divided into an intranet feature analysis and generation subsystem 100, a topology information hiding subsystem 200, a behavior audit tracking subsystem 300 and a distributed topology mapping verification subsystem 400 at the software level.

[0123] The intranet feature analysis and generation subsystem 100 mainly collects information about various types of internal networks in different network environments and generates an intranet topology structure that meets the requirements of the intranet topology characteristics. Optionally, the intranet feature analysis and generation subsystem 100 includes a typical intranet topology collection and feature extraction module 110, an intranet topology intelligent generation module 120, and a typical intranet topology structure library 130.

[0124] The typical intranet topology collection and feature extraction module 110 can use network topology detection methods to map the intranet topology structure of a specific scenario, and collect the node connection relationship in the intranet topology structure, analyze the characteristics of the intranet topology structure from different dimensions such as connection degree, betweenness centrality, and clustering coefficient, and obtain typical intranet topology structure characteristics.

[0125] The intranet topology intelligent generation module 120 can automatically generate a virtual intranet topology structure that meets specific scenarios based on typical intranet topology structure characteristics and according to parameter configurations input by the user, and assign corresponding IP address information to each virtual node in the virtual intranet topology structure.

[0126] The typical intranet topology structure library 130 can store the virtual intranet topology structure automatically generated by the intranet topology intelligent generation module 120 , so as to facilitate the topology information hiding subsystem 200 to perform topology obfuscation.

[0127] The topology information hiding subsystem 200 mainly identifies and obfuscates network topology detection traffic based on the intranet topology structure selected from the typical intranet topology structure library 130. Optionally, the topology information hiding subsystem 200 includes a detection behavior detection module 210 and a topology detection response module 220.

[0128] The detection behavior detection module 210 can perform deep packet inspection on the messages passing through the network and identify the topology detection messages that detect the internal network topology structure. If the source IP address of the topology detection message is not in the whitelist database, corresponding topology information hiding processing is required.

[0129] The topology detection response module 220 can determine the corresponding virtual node based on the intranet topology structure selected from the typical intranet topology structure library 130 and the TTL value of the topology detection message to respond to the topology detection behavior and return the corresponding forged source IP address of the virtual node, thereby achieving the purpose of hiding topology information.

[0130] The behavior audit tracking subsystem 300 mainly collects the host's scanning behavior data, and combines various network intelligence to perform correlation analysis on the subject information of the scanning and detection behaviors. By combining other behavior data, it further determines whether there is an APT (Advanced Persistent Threat) attack behavior. Optionally, the behavior audit tracking subsystem 300 includes a detection subject correlation analysis module 310, an APT attack behavior discrimination module 320, and a security intelligence database 330.

[0131] The detection subject association analysis module 310 can record and collect detection behaviors, and audit and analyze the collected detection behaviors, mine the host information and associated information of the detection, and assist in tracing the malicious behavior subject.

[0132] The APT attack behavior identification module 320 can combine other collected network traffic and attack behaviors to mine and analyze the entire detection, penetration, and attack behavior chain to determine whether there is APT attack behavior.

[0133] The security intelligence database 330 can collect and store relevant network security intelligence data from different channels, and provide data support for the detection subject association analysis module 310 and the APT attack behavior identification module 320.

[0134] The distributed topology mapping verification subsystem 400 mainly constructs a detection platform with detection nodes distributed in different network areas of the Internet, detects the intranet topology structure that implements topology information hiding, and confirms whether the topology information hiding goal is achieved as required. Optionally, the distributed topology mapping verification subsystem 400 includes a detection node management module 410, a detection task management module 420, a detection task execution module 430, and a detection result recovery module 440.

[0135] The detection node management module 410 can manage the detection nodes to perform topology detection tasks, including adding, modifying, deleting, and viewing the detection nodes, and monitor the running status of the detection nodes in real time.

[0136] The detection task management module 420 can manage the topology detection tasks to be executed in the detection platform, including the creation, suspension, modification, and deletion of topology detection tasks, and monitor the execution of topology detection tasks in real time.

[0137] The detection task execution module 430 can create a network topology mapping execution environment in the detection node, receive management and task distribution from the detection platform, and execute corresponding topology detection tasks according to the requirements of the detection platform.

[0138] After completing the distributed topology detection of a specific intranet, the detection result recovery module 440 can collect the topology detection results of each detection node, restore the intranet topology structure, and compare it with the intranet topology structure fictitious by the topology information hiding subsystem 200, so as to verify whether the topology information achieves the obfuscation effect.

[0139] Next, combine Figure 1 , introduces the network anti-mapping method provided by the embodiment of this application. For details, please refer to Figure 2 , which is a flowchart of a network anti-mapping method provided by an exemplary embodiment of the present application, such as Figure 2 As shown, the network anti-mapping method includes the following steps:

[0140] S201, performing content detection on messages transmitted in a target network, identifying and determining a topology detection message containing a network topology detection behavior.

[0141] Specifically, in the network anti-mapping system, all messages transmitted in the target network will be deeply analyzed to identify those specific messages that may attempt to detect the network topology, namely topology detection messages. Topology detection messages usually belong to network detection behaviors, such as Traceroute, port scanning, etc., through which attackers try to understand the internal structure and node distribution of the network.

[0142] The target network refers to the network environment protected by the network anti-mapping system, such as the internal network of an organization or a critical infrastructure network. The devices and topology in the target network are what the attacker wants to detect.

[0143] A message is a data packet in network communication, which contains information transmitted in the network. Each message includes header information (such as source IP address, destination address) and data payload (such as actual communication content).

[0144] Content inspection is to analyze the header information and data payload of the message, for example, to check whether the message contains abnormal, suspicious or specific behavior characteristics. Content inspection can involve checking the protocol type, port number, data content, TTL value, etc. of the message.

[0145] Network topology detection behavior refers to the attacker's attempt to draw the network topology structure, that is, the distribution of various devices and nodes in the network, through specific means and tools (such as Traceroute, port scanning, etc.). Network topology detection behavior can help attackers understand the internal structure of the network and prepare for further attacks.

[0146] Content inspection can identify packets that show network topology detection behavior. For example, some packets with increasing TTL values ​​and directed to different nodes may be identified as Traceroute detection packets. After identification, these packets are marked as topology detection packets.

[0147] By performing in-depth content inspection on the packets in transit, it is possible to identify which packets are attempting to detect the network topology and mark them as topology detection packets. In this way, appropriate defensive measures can be taken, such as faking responses or blocking communications, to protect the target network's topology information from being leaked.

[0148] In some embodiments, the above-mentioned content detection of the message transmitted in the target network, identifying and determining the topology detection message containing the network topology detection behavior, includes:

[0149] Check whether the source IP address of the message transmitted in the target network belongs to the whitelist;

[0150] If it is confirmed that the source IP address of the message does not belong to the whitelist, deep packet inspection is performed on the message. Based on the deep packet inspection result of the message and the preset network topology detection behavior characteristics, the topology detection message containing the network topology detection behavior is identified and determined.

[0151] Specifically, the first step is to check whether the source IP address of the message in transit is on the whitelist. The whitelist usually includes known and trusted IP addresses, which are considered not to conduct malicious detection or attacks on the network. If the source IP address of the message is on the whitelist, the message is considered safe and its content will not be further checked. This will not affect the normal communication of the target network, and can also reduce the consumption of system resources, focusing on detecting traffic that is more likely to pose a threat.

[0152] If the source IP address of the message is not in the whitelist, the message will be subjected to deep packet inspection. Deep packet inspection is a technology that deeply analyzes the content of the message, and can view the application layer data, protocol type, port number, TTL value and other information of the message. Through deep packet inspection, the characteristics of the message can be analyzed in more detail to determine whether it meets the preset network topology detection behavior characteristics, thereby further confirming whether the message may be a malicious detection behavior.

[0153] The deep packet inspection results are compared with the preset network topology detection behavior characteristics. If the data characteristics of the message meet these preset network topology detection behavior characteristics, it will be identified and determined as a topology detection message. Topology detection messages may be performing network scanning, path detection (such as Traceroute), etc., attempting to draw the network topology structure.

[0154] The data features of a message refer to the content and behavior pattern of the message, such as the TTL value change pattern of the message, the choice of the target port, the type of protocol used, etc. These features are used to identify the detection behavior. The preset network topology detection behavior features are set according to the known detection behavior patterns, so as to judge whether the message belongs to the topology detection behavior by comparing with the preset network topology detection behavior features.

[0155] In this way, messages that meet the preset network topology detection behavior characteristics can be marked as topology detection messages, so that further defense measures can be taken to ensure that the topology structure of the target network is not easily obtained by external malicious detectors, thereby protecting the security of the network.

[0156] In some embodiments, the above-mentioned topology detection message includes a topology detection message based on the ICMP protocol, a topology detection message based on the UDP protocol, and a topology detection message based on the TCP protocol.

[0157] Specifically, the main purpose of network topology detection behavior is to identify and analyze abnormal traffic patterns in the network, so as to discover potential security threats. Topology detection messages that contain network topology detection behavior are usually those designed to discover and record network path information, among which Traceroute is one of the most common tools. Traceroute tracks the transmission path of data packets from source to destination by sending a series of probe packets with different TTL values. Every time a probe packet is forwarded on each hop node in the network, the TTL value decreases. When the TTL value is reduced to 0, the probe packet will be discarded, and the intermediate node will return an ICMP "time exceeded" message to the source host. By recording the source IP address of these ICMP messages, Traceroute can depict the transmission path of the probe packet.

[0158] In addition, other types of topology detection messages, such as port scanning and path detection based on ICMP, UDP and TCP, are also possible network topology detection behaviors. Based on the universality of these network topology detection behaviors, network anti-mapping systems need to effectively identify and respond to these messages to prevent attackers from obtaining the real topology information of the target network through such tools. Therefore, messages generated by Traceroute and other similar detection tools can be identified and disguised, thereby effectively hiding the internal structure of the network.

[0159] Among them, topology detection messages of different protocols have their own corresponding network topology detection behavior characteristics.

[0160] In some embodiments, the ICMP protocol-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0161] The data volume of the message is less than the preset data volume;

[0162] The TTL values ​​between packets with the same source IP address gradually increase;

[0163] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0164] Specifically, Traceroute based on the ICMP protocol uses ICMP's "Time Exceeded" and "Destination Unreachable" messages to trace the transmission path of the data packet. Its working principle is to send a series of ICMP echo request packets with increasing TTL values ​​to the target host. Every time a data packet passes through a router in the network, the TTL value is reduced by 1. When the TTL value is reduced to 0, the router will discard the data packet and return an ICMP "Time Exceeded" message to the sender. By receiving these ICMP messages, the sender can determine the IP address of each node that the data packet passes through in the network. This process will be repeated until the data packet successfully reaches the target host or reaches the preset maximum number of hops, thereby drawing the complete path of the data packet from the source to the destination, and can also bypass certain firewalls that only allow specific protocol traffic.

[0165] Among them, the data volume of the topology detection message based on the ICMP protocol is relatively small, because its main purpose is to generate ICMP responses rather than transmit large amounts of data. The TTL value between messages with the same source IP address gradually increases, indicating that the topology detection message is designed to gradually detect each hop in the network path, thereby depicting the complete transmission path. The difference in the sending interval between messages with the same source IP address is less than the preset time threshold, indicating that the topology detection message is sent at a fixed or approximately fixed time interval to ensure the continuity and accuracy of path detection.

[0166] In some embodiments, the UDP protocol-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0167] The port number of the destination address of the message is greater than 1024;

[0168] The TTL values ​​between packets with the same source IP address gradually increase;

[0169] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0170] Specifically, Traceroute based on UDP protocol sends a series of UDP packets to the target host. UDP packets usually use a random, uncommon high port number as the target port, in the hope that the target machine will return an ICMP "destination unreachable" message. Specifically, Traceroute based on UDP protocol sends a series of UDP packets with increasing TTL values ​​to a high port number that is usually not open on the target host. Every time a packet passes through a router in the network, the TTL value is reduced by 1. When the TTL value drops to 0, the router discards the UDP packet and returns an ICMP "time exceeded" message to the source host. The ICMP message received by the source host contains the IP address of the router that discarded the UDP packet, so that the path of the packet in the network can be determined. This process is repeated until the packet successfully reaches the target host or the preset maximum number of hops is reached. Traceroute based on UDP protocol can bypass firewalls that only allow TCP traffic because UDP packets are usually not blocked by these firewalls.

[0171] Among them, topology detection messages based on the UDP protocol usually use high port numbers (for example, port numbers greater than 1024), which are mostly not used by conventional applications, so they can cause the target host to return a "destination unreachable" message. In normal UDP communication, a large number of destination unreachable messages are not common. The TTL value between messages with the same source IP address gradually increases, indicating that the topology detection message is designed to gradually detect each hop in the network path, thereby depicting the complete transmission path. The difference in the sending interval between messages with the same source IP address is less than the preset time threshold, indicating that the topology detection message is sent at a fixed or approximately fixed time interval to ensure the continuity and accuracy of path detection.

[0172] In some embodiments, the TCP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0173] The message is a TCP SYN packet;

[0174] The port number of the destination address of the message is greater than the preset port number or belongs to the specified port number;

[0175] The TTL values ​​between packets with the same source IP address gradually increase;

[0176] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0177] Specifically, Traceroute based on the TCP protocol uses TCP SYN packets to perform path tracing. This method sends a series of TCP SYN (Synchronization Sequence Number) packets with increasing TTL values ​​to a specific port of the target host. Every time a TCP SYN packet passes through a router in the network, the TTL value is reduced by 1. When the TTL value drops to 0, the router discards the TCP SYN packet and returns an ICMP "Time Exceeded" message. If the TCP SYN packet reaches the target host but the port is not open, the target host returns a TCP RST (reset) packet. By receiving these ICMP or TCPRST messages, the source host can determine the transmission path of the data packet in the network. This process is repeated until the data packet successfully reaches the target host or reaches the preset maximum number of hops. Traceroute based on the TCP protocol can penetrate network environments that filter UDP and ICMP packets.

[0178] Among them, the topology detection message based on the TCP protocol uses the TCP SYN packet, because this is the initial step to establish a TCP connection and is widely used for path tracing. The topology detection message uses a high port number (for example, a port number greater than 1024) or an uncommon specific port number for path tracing, which can cause the target host to return a TCP RST packet and bypass conventional security filtering measures. The TTL value between messages with the same source IP address gradually increases, indicating that the topology detection message is designed to gradually detect each hop in the network path, thereby depicting the complete transmission path. The difference in the sending interval between messages with the same source IP address is less than the preset time threshold, indicating that the topology detection message is sent at a fixed or approximately fixed time interval to ensure the continuity and accuracy of path detection.

[0179] It should be noted that when identifying and determining topology detection messages containing network topology detection behaviors, a delay judgment strategy can be used to collect messages from the same source IP address within a certain time window. This time window can be from a few seconds to a few minutes, depending on the system design and network environment. After collecting enough messages, the behavior characteristics of these messages will be comprehensively analyzed. For example, it will be checked whether the TTL value of the message is gradually increasing, whether the size of the data packet is small, whether the sending interval is fixed or approximately fixed, etc. Through this comprehensive analysis, it can be more accurately determined whether these messages belong to network topology detection behaviors. Delay judgment can avoid misjudgment due to unclear characteristics of a single message by analyzing the overall behavior pattern of the message. Messages whose source IP addresses belong to the whitelist can be considered to come from a trusted source and can be directly processed without delay judgment. Whitelist messages can be released immediately, or response messages from the real network can be quickly generated and returned, avoiding potential response delays caused by delay judgment and ensuring normal communication of the system.

[0180] S202: Match a target virtual node in a specified virtual topology structure based on the target information of the topology detection message.

[0181] Specifically, according to the target information contained in the topology detection message, a suitable virtual node is found in a preset virtual topology structure to respond to the detector, thereby confusing the other party and preventing it from obtaining the real network topology information. Figure 3 FIG. 1 is a diagram showing an example of a network topology structure, including the connection relationship between various devices in the network (such as routers, switches, servers, etc.).

[0182] The target information includes the target address of the topology detection message (such as IP address and port number) and other characteristics related to the message path (such as TTL value). The target information indicates the path information of which node in the target network the detector wants to access or understand. The target address is the IP address or port of the node that the topology detection message will eventually reach; the TTL value is used to determine the survival time of the data packet of the topology detection message in the network, which decreases each time the data packet passes through a router until it drops to 0, triggering an ICMP "timeout message".

[0183] The virtual topology is a virtual network model preset by the system to simulate the topology of a real network. The virtual topology does not reflect the real network layout, but is an artificially designed false network used to confuse the detector. Through disguise and confusion, the detector can believe that it has successfully detected the real network topology.

[0184] According to the target information of the topology detection message, considering factors such as the target address and TTL value, a suitable target virtual node is selected in the virtual topology structure to respond to the detector, and by forging the response message, the detector thinks that it has identified the real nodes and paths in the network. The target virtual node is a hypothetical node in the virtual topology structure, which simulates a possible node in the real network and forges the IP address information.

[0185] In some embodiments, the target information based on the topology detection message matches the target virtual node in the specified virtual topology structure, including:

[0186] Matching associated virtual nodes in the virtual topology structure based on the target address of the topology detection message;

[0187] Check whether the TTL value of the topology detection message reaches the preset TTL value corresponding to the associated virtual node;

[0188] If so, the associated virtual node is used as the target virtual node;

[0189] If not, the target virtual node is matched according to the TTL value of the topology detection message and the virtual topology structure.

[0190] Specifically, first, according to the target address (such as IP address and port number) in the topology detection message, a virtual node corresponding to the target address is found in the virtual topology structure. This virtual node is the associated virtual node, which is a node initially selected in the virtual topology according to the target address. It is not a node in the real network, but a virtual node used to confuse the detector.

[0191] Next, it will be checked whether the TTL value in the topology detection message is sufficient to reach the associated virtual node. Each virtual node in the virtual topology structure will preset a TTL value when it is designed. This preset TTL value indicates what the TTL should be when the data packet reaches the virtual node. By comparing the actual TTL value of the topology detection message and the preset TTL value corresponding to the associated virtual node, it can be determined whether the data packet of the topology detection message can reach the associated virtual node. If the TTL value of the topology detection message is greater than or equal to the preset TTL value of the associated virtual node, it means that the data packet of the topology detection message can reach the associated virtual node, and the associated virtual node can be determined as the final target virtual node to generate a response message to deceive the detector. If the TTL value of the topology detection message is less than the preset TTL value of the associated virtual node, it means that the data packet of the topology detection message cannot reach the associated virtual node. It is necessary to find a more suitable virtual node in the virtual topology structure according to the TTL value of the topology detection message (for example, other nodes that are more in line with the TTL value of the topology detection message) and determine it as the final target virtual node to generate a response message to deceive the detector. In this way, through the dynamic adjustment of the target virtual node, even if the detector's message does not follow the expected path, the system can still generate a reasonable response, making the detector mistakenly believe that the real network topology has been detected, thereby effectively hiding the layout and information of the real network.

[0192] Exemplarily, suppose that an attacker is trying to use the Traceroute tool to detect the topology of the target network. The target network deploys multiple virtual nodes in a specified virtual topology. The attacker sends a topology detection message from his device. The topology detection message is captured when it enters the target network. The capture node is a node in the network responsible for detecting and processing incoming traffic, such as a firewall, an intrusion detection system (IDS), or a network monitoring device. The capture node obtains the target information of the topology detection message, obtains the target port and current TTL value of the topology detection message, and the TTL value is assumed to be 20. According to the target port of the topology detection message, an associated virtual node is matched in the virtual topology. Assuming that the preset TTL value of the associated virtual node is 15, it means that it takes 15 hops for the data packet to reach the associated virtual node normally from the capture node. At this time, the data packet of the topology detection message can reach the associated virtual node, and the associated virtual node can be used as the target virtual node to generate a response message (such as ICMP "destination unreachable"). Assuming that the preset TTL value of the associated virtual node is 25, it means that it takes 25 hops for the data packet to reach the associated virtual node normally from the capture node. At this time, the data packet of the topology detection message cannot reach the associated virtual node. It is necessary to determine an intermediate virtual node corresponding to the TTL value of 25 in the virtual topology structure as the target virtual node to indicate the virtual node where the data packet of the topology detection message arrives when the TTL value drops to 0 on the way to the associated virtual node. The intermediate virtual node is used as the target virtual node to generate a response message (such as ICMP "time exceeded"). Thus, the network anti-mapping system can dynamically select a suitable target virtual node to generate a reasonable response message to achieve the best deception effect, so that the detector cannot detect the real network topology structure, thereby protecting the security and privacy of the network.

[0193] In some embodiments, the virtual topology structure is generated based on a network topology structure in a network topology structure library.

[0194] Specifically, the virtual topology is generated based on the network topology in the network topology library. The network topology library is a database containing multiple network topologies. These network topologies can be predefined topologies generated based on real network environments, or customized topologies based on specific needs. When performing network anti-mapping, one or more suitable network topologies are selected from the network topology library, and a virtual topology is generated based on the configuration data input by the user. The virtual topology is used to simulate the real network environment. The purpose is to confuse the detector through the disguised topology when the detector performs network detection, so that it cannot obtain the real network information.

[0195] It should be noted that the virtual topology structure can directly use the network topology structure in the network topology structure library, or use the network topology structure in the network topology structure library as a template to customize and generate the virtual topology structure as required based on the configuration information input by the user.

[0196] In some embodiments, before matching at least one target virtual node in the specified virtual topology structure, the method further includes:

[0197] Obtain network topology data for various network environment types;

[0198] A variety of network topology structures are generated based on the network topology data and the input configuration information, and are stored in a network topology structure library.

[0199] Specifically, we first collect various types of network environment data. These data may come from different network environments, such as the Internet of Things, industrial control systems, data centers, office networks, and other scenarios. Each network environment has its own unique topology and configuration characteristics. Each network topology data can come from actual network configuration files, network monitoring data, test data in a simulated environment, or network configuration files obtained from partners and other trusted sources.

[0200] Exemplarily, network topology detection technology can be used to perform non-intrusive topology mapping on a network in a specific environment under a trusted source to obtain network topology data of various network environment types, providing basic data for subsequent analysis and forgery.

[0201] Generally speaking, the commonly used network topology inference methods are mainly divided into two types: Traceroute-based topology inference and network tomography-based topology inference. Traceroute-based topology inference sends data packets with different TTL values ​​and infers the network topology based on the response information returned by the intermediate routing devices. However, network tomography-based topology inference does not rely on the cooperation of internal nodes, and can infer the internal topology of the network only through end-to-end measured path performance information (such as packet loss rate, delay, etc.).

[0202] Network tomography obtains the characteristics of the network through end-to-end measurement technology, on the premise that the path measurement information observed outside the network can truly reflect the performance of the links inside the network. Multi-source network tomography sends probe packets between multiple source nodes and destination nodes and models them as a directed acyclic graph G S×D , where S represents the set of detection source nodes and D represents the set of detection destination nodes. Figure 4 As shown, the example is an M×N (2×4) multi-source network tomography topology inference model, the source node is S = {S1, S2}, and the destination node is D = {d1, d2, d3, d4}. Si×D(i=1,…,M) represents a tree with S i is a 1×N tree of source nodes.

[0203] Topology inference based on network tomography is mainly divided into three steps: measuring end-to-end performance, calculating correlation performance, and reconstructing network topology. First, a probe data packet is sent from the source node {S1, S2} to the destination node {d1, d2, d3, d4}. The probe packet reaches the destination node through different paths within the network. The destination node collects information related to path performance, such as packet loss rate, delay, etc. Then, the correlation between network nodes is calculated based on these path performance data. The larger the path correlation performance value, the longer the shared path between nodes and the stronger the correlation between nodes. Finally, the system infers the topological structure of the target network based on the correlation value between nodes.

[0204] The topology inference process of M×N multi-source network tomography is mainly divided into two steps: first, the system obtains the tree topology structure of each source node through the single-source network tomography method; then, by detecting the topological structure between different source nodes, the topologies of each source node are gradually merged to finally form a complete network topology.

[0205] After obtaining network topology data of various types of network environments, these data will be deeply analyzed and processed. Network topology data usually includes node information in the network (such as routers, switches, servers), connection methods, number of hops between nodes, etc. For example, graph theory, complex network analysis and other methods can be used to quantitatively analyze the characteristics of the intranet topology structure from different dimensions such as connection degree, betweenness centrality, and clustering coefficient. Connection degree analysis can reveal the connectivity and importance of nodes in the intranet, and identify those highly connected nodes that play a key role in the network; betweenness centrality analysis helps identify those nodes with high control and influence in the network; and clustering coefficient analysis is used to evaluate the degree of connection between node neighbors, revealing the local connectivity and clustering characteristics of the intranet. The results of these analyses can provide key reference information for subsequent network configuration.

[0206] Next, various virtual network topologies will be generated based on these analysis results and specific configuration information entered by the user or system administrator (such as the network scale, complexity, node type, topology shape, etc. that you want to simulate). By combining the quantitative analysis of network topology data with the user's configuration requirements, it is possible to create virtual network topologies that meet different types of requirements and simulate various network environments to improve network security and concealment.

[0207] The created virtual network topology will be stored in the network topology library. Various network topologies in the network topology library can be called in different scenarios or used as templates to configure new virtual topologies to deal with various network detection behaviors.

[0208] S203: Generate and return a response message based on the target virtual node.

[0209] Specifically, after the target virtual node is matched in the virtual topology structure based on the target information (such as the target address and TTL value) in the topology detection message, a response message is generated according to the target virtual node and returned to the detector.

[0210] The response message simulates the response of the target virtual node, with the purpose of making the detector mistakenly believe that they have detected a real network node and record the forged node information.

[0211] The response message includes the forged source IP address of the target virtual node. The forged source IP address is not the address of a node in the real network, but a fake source IP address generated by the system. The forged source IP address corresponds to the previously selected target virtual node, with the purpose of deceiving the detector into thinking that the address corresponds to a real network node.

[0212] By returning a response message with a forged source IP address, the detector can believe that the detected node does exist in the network, and continue to speculate the network topology through the forged source IP address of the target virtual node. However, these speculations are based on false information, thus protecting the real network structure from being leaked.

[0213] In the embodiment of the present application, by dynamically matching the target virtual node in the virtual topology structure and generating a forged response message, the detector cannot distinguish the real network structure and effectively hide the internal network topology. By using the target address and TTL value in the detection message, the response strategy can be flexibly adjusted to ensure that the returned forged information conforms to the detector's expected path and increase confusion. By dynamically generating forged response messages, the detector is prevented from obtaining network topology information through traditional scanning and detection methods, thereby improving the overall security protection capabilities of the network.

[0214] See next Figure 5 , which is a flow chart of another network anti-mapping method provided by an exemplary embodiment of the present application, such as Figure 5 As shown, the network anti-mapping method includes the following steps:

[0215] S501, confirm whether the source IP address of the message belongs to the blacklist or the whitelist.

[0216] Specifically, each network packet has a source IP address that identifies which IP address or device the packet came from. A blacklist is a group of known untrusted or malicious IP addresses. Blacklists are associated with known attackers, malicious activities, or unauthorized devices. A whitelist is a group of trusted IP addresses. Whitelists usually represent known, safe devices or users.

[0217] When it is confirmed that the source IP address of the message belongs to the whitelist, execute step S502;

[0218] When it is confirmed that the source IP address of the message belongs to the blacklist, execute step S503;

[0219] When it is confirmed that the source IP address of the message does not belong to the blacklist or the whitelist, step S504 is executed.

[0220] S502: Determine the message as a trusted message.

[0221] Specifically, when it is confirmed that the source IP address of the message belongs to the whitelist, the message will not be subjected to deep packet inspection or other complex security checks, and the whitelisted message can obtain the response of the real network. In this way, the processing time can be reduced, the system load can be reduced, the efficiency of network communication can be improved, and the normal communication of the network will not be affected.

[0222] S503: Determine the message as a topology detection message.

[0223] Specifically, when it is confirmed that the source IP address of the message belongs to the blacklist, the message will be directly identified as a topology detection message. This is because blacklists are usually related to malicious activities, and detection behavior may be one of their intentions. Through this strategy, potential threats can be quickly identified and responded to, preventing attackers from obtaining sensitive topology information of the network, thereby effectively protecting network security.

[0224] S504, performing deep packet inspection on the message, and identifying and determining a topology detection message containing a network topology detection behavior based on the deep packet inspection result of the message and a preset network topology detection behavior feature.

[0225] Specifically, when it is confirmed that the source IP address of the message is neither in the blacklist nor in the whitelist, the message will be subjected to deep packet inspection. Through deep packet inspection, the characteristics of the message can be analyzed in more detail to determine whether it meets the preset network topology detection behavior characteristics, thereby further confirming whether the message may be a malicious detection behavior. The specific identification process of the topology detection message can be referred to step S201, which will not be repeated here.

[0226] S505 : Match a target virtual node in a specified virtual topology structure based on the target information of the topology detection message.

[0227] Specifically, step S505 is consistent with step S202 and will not be described in detail here.

[0228] S506: Generate and return a response message based on the target virtual node.

[0229] Specifically, step S506 is consistent with step S203 and will not be described in detail here.

[0230] In some embodiments, after confirming that the source IP address of the message belongs to the blacklist, the following steps are included:

[0231] Check whether the risk level of the source IP address of the message in the blacklist is higher than the risk threshold;

[0232] If yes, the message is determined to be a topology detection message;

[0233] If not, perform deep packet inspection on the message, and identify and determine the topology detection message containing the network topology detection behavior based on the deep packet inspection result of the message and the preset network topology detection behavior characteristics.

[0234] Specifically, in the blacklist, the source IP address of the message may be assigned different risk levels. The risk level can be evaluated based on factors such as historical behavior, associated malicious activities, and attack frequency. The risk level reflects the degree to which a source IP address is considered to pose a threat to the network. By setting a risk threshold, it can be determined whether the message should be processed directly. When it is detected that the source IP address of the message belongs to the blacklist, the risk level of the source IP address in the blacklist is further checked and compared with the preset risk threshold. If the risk level of the source IP address of the message exceeds the risk threshold, the message will be immediately marked as a topology detection message. Because high-risk IP addresses are usually closely related to malicious detection or attack behaviors, there is no need for further analysis, and they are directly processed as topology detection messages, which reduces system resource consumption, quickly responds to potential threats, and prevents them from further affecting the network. If the risk level of the source IP address of the message does not reach the risk threshold, it will not be immediately determined as a topology detection message. Instead, the message will be further analyzed to determine its true intention.

[0235] In some embodiments, after identifying and determining a topology detection message containing a network topology detection behavior, the method further includes:

[0236] Check whether the source IP address of the topology detection message is on the blacklist.

[0237] If not, the source IP address of the topology detection message is added to the blacklist and assigned an initial risk level, which is lower than the risk threshold;

[0238] If so, the risk level of the topology detection message in the blacklist is updated based on the preset risk rule.

[0239] Specifically, after the topology detection message is identified, it is first checked whether the source IP address of the identified topology detection message already exists in the blacklist to determine whether the specific IP address has been marked as a potential threat.

[0240] If the source IP address of the topology detection message is not in the blacklist, the source IP address will be added to the blacklist and assigned an initial risk level, which reflects the initial threat assessment of the source IP address. The initial risk level is usually low (lower than the risk threshold, such as the minimum risk level), because only one suspicious behavior may have been detected at this time, and it has not yet been confirmed whether it poses a greater threat. The low initial risk level means that the activities of the source IP address will continue to be monitored, and whether to increase its risk level will be determined based on its subsequent behavior. Over time, if the behavior of the source IP address continues to show suspicious or malicious signs, its risk level may be gradually increased.

[0241] If the source IP address of the topology detection message already exists in the blacklist, the risk level of the source IP address will be updated according to the preset risk rules. For example, if the source IP address in the blacklist frequently sends topology detection messages, its risk level can be increased.

[0242] It is understood that the risk level can be determined and updated based on a series of rules and conditions. Risk rules may include but are not limited to:

[0243] Frequency: The frequency of topology detection performed by the source IP address in a short period of time. If the detection frequency is higher than the frequency threshold, the risk level can be increased.

[0244] Behavior Complexity: If the detection behavior exhibits more complex characteristics (such as the use of advanced detection techniques or tools), the risk level can be further increased.

[0245] History: The historical behavior record of the source IP address, such as whether it has participated in other types of attack activities in the past. If there is a malicious history, the risk level can be increased.

[0246] Relevance: Is the source IP address related to a known attacker or malicious network? If so, the risk level can be increased.

[0247] In some embodiments, a risk score may be assigned to each suspicious behavior or detection behavior. When a source IP address performs suspicious behavior again, the system will increase the total risk score of the source IP address according to preset rules. When the accumulated risk score reaches a certain score threshold, the risk level will be raised to a higher level.

[0248] In addition, the risk level can be dynamically adjusted based on the behavior of the source IP address. If the source IP address continues to show high risk (frequently sending topology detection messages), the system can raise its risk level to a higher category. For example, from "medium risk" to "high risk". Conversely, if no suspicious activities are detected for the source IP address over a period of time, its risk level can also be lowered, thereby optimizing resource allocation.

[0249] In some embodiments, the method further comprises:

[0250] Obtain network security intelligence data from multiple sources and record network traffic data of the target network;

[0251] Identify suspicious entities based on cybersecurity intelligence data and network traffic data;

[0252] Add the source IP address of the suspicious subject to the blacklist, and the risk level of the source IP address of the suspicious subject is higher than the risk threshold.

[0253] Specifically, cybersecurity intelligence data can come from multiple sources, such as threat intelligence platforms, intelligence shared by partners, public security vulnerability information, historical attack data, etc. Cybersecurity intelligence data can help identify the latest threat patterns, known attacker IP addresses, malware characteristics, etc.

[0254] At the same time, the system continuously monitors and records all data traffic in the target network, including all incoming and outgoing network communications, such as IP addresses, port numbers, protocol types, traffic sizes, etc. This data provides a real-time view of network activity and helps identify abnormal behavior.

[0255] The system compares and analyzes the collected network security intelligence data with the recorded network traffic data, and can identify traffic or activities that match known threat patterns or suspicious behaviors. For example, if an IP address is marked as malicious in the network security intelligence data, and this IP address also appears in the traffic records of the target network, then this IP address may be identified as a suspicious subject.

[0256] Through comprehensive analysis, potential threats in the network can be identified, which may include malicious IP addresses, abnormal traffic patterns, suspicious login attempts, etc. Suspicious subjects refer to IP addresses or devices that exhibit potential malicious behavior or abnormal activities. Once the system identifies a suspicious subject, the source IP address of the subject will be added to the blacklist and assigned a high risk level (higher than the risk threshold) so that the message from the source IP address can be directly processed as a topology detection message, reducing system resource consumption, quickly responding to potential threats, and preventing them from further affecting the network.

[0257] By acquiring cybersecurity intelligence data from multiple sources and monitoring network traffic, the system is able to identify suspicious entities and add their source IP addresses to the blacklist. In this way, the system can effectively prevent known threats from entering the network while ensuring continuous monitoring and response to potential threats.

[0258] See next Figure 6 , which is a flowchart of a verification process of a network anti-mapping method provided by an exemplary embodiment of the present application, such as Figure 6 As shown, the network anti-mapping method includes the following steps:

[0259] S601, using distributed detection nodes set in different network areas to perform a topology detection task on a target network to obtain a detection topology structure.

[0260] Specifically, distributed detection nodes are nodes deployed in different network areas and are responsible for performing detection tasks. Distributed detection nodes can be located in different subnets of the network, different geographical locations, or different network levels to ensure comprehensive coverage of all parts of the target network.

[0261] Distributed detection nodes perform topology detection tasks by sending detection data packets (such as Traceroute or other detection protocol packets). These data packets gradually collect information about paths, nodes, hop counts, etc. when they are transmitted in the network, helping to build the actual topology of the target network.

[0262] By collecting and summarizing the detection data of all distributed detection nodes, the system can draw the detection topology of the target network. The detection topology reflects the layout and connection mode of network nodes and paths from the perspective of the detector.

[0263] S602, comparing the detected topology with the virtual topology to verify the effectiveness of the target network's anti-mapping.

[0264] Specifically, the detection topology obtained by the distributed detection nodes is compared with the pre-set virtual topology. The virtual topology is an imaginary network layout designed by the system to confuse the detector, which is different from the real network topology.

[0265] By comparing the two, we can evaluate the effectiveness of the virtual topology in hiding the real network layout. If the detection topology is highly consistent with the virtual topology, it means that the virtual topology has successfully confused the detection behavior and the anti-mapping technology has played its due role. If there is a large difference, it means that the target network has low anti-mapping ability and needs to adjust the virtual topology or anti-mapping strategy. In this way, the concealment of the real network topology information can be ensured, the network's protection capabilities can be enhanced, and attackers can be prevented from obtaining key network structure information through mapping methods.

[0266] See next Figure 7 , which is a flow chart of another network anti-mapping method provided by an exemplary embodiment of the present application, such as Figure 7 As shown, the network anti-mapping method includes the following steps:

[0267] S701, determine whether the source IP address of the message belongs to the whitelist.

[0268] Specifically, the whitelist is a group of trusted IP addresses. The whitelist usually represents known, safe devices or users. If the source IP address of the message belongs to the whitelist, it means that the message is a trusted message, and step S707 is executed; if the source IP address of the message does not belong to the whitelist, step S702 is executed.

[0269] S702: Determine whether the source IP address of the message belongs to the blacklist.

[0270] Specifically, a blacklist is a set of known untrusted or malicious IP addresses. A blacklist is associated with known attackers, malicious activities, or unauthorized devices. If the source IP address of the message belongs to the blacklist, it means that the message may have a potential threat, and step S703 is executed; if the source IP address of the message does not belong to the blacklist, step S704 is executed.

[0271] It should be noted that the blacklist in step S702 may be determined based on network security intelligence data and network traffic data, specifically including:

[0272] S721, obtain network security intelligence data from multiple sources and record network traffic data of the target network.

[0273] S722, identify suspicious entities based on network security intelligence data and network traffic data.

[0274] S723: Add the source IP address of the suspicious subject or topology detection message to a blacklist.

[0275] Through comprehensive analysis, potential threats in the network can be identified, which may include malicious IP addresses, abnormal traffic patterns, suspicious login attempts, etc. Suspicious subjects refer to IP addresses or devices that exhibit potential malicious behavior or abnormal activities. Once the system identifies a suspicious subject, the source IP address of the subject will be added to the blacklist and assigned a high risk level (higher than the risk threshold) so that the message from the source IP address can be directly processed as a topology detection message, reducing system resource consumption, quickly responding to potential threats, and preventing them from further affecting the network.

[0276] It should be noted that after the message is determined as a topology detection message in step S706, it is confirmed whether the source IP address of the topology detection message belongs to the blacklist; if not, the source IP address of the topology detection message is added to the blacklist and assigned an initial risk level, which is lower than the risk threshold; if so, the risk level of the topology detection message in the blacklist is updated based on the preset risk rules.

[0277] S703: Determine whether the risk level of the source IP address of the message is higher than the risk threshold.

[0278] Specifically, in the blacklist, the source IP address of the message may be assigned different risk levels. The risk level can be assessed based on factors such as historical behavior, associated malicious activities, and attack frequency. The risk level reflects the degree to which a source IP address is considered to pose a threat to the network. If the risk level of the source IP address of the message is higher than the risk threshold, execute step S706; if the risk level of the source IP address of the message is not higher than the risk threshold, execute step S704.

[0279] S704: Perform deep packet inspection on the message.

[0280] Specifically, deep packet inspection is a technology that deeply analyzes the content of a message, and can view the message's application layer data, protocol type, port number, TTL value, and other information. Through deep packet inspection, the message's features can be analyzed in more detail to determine whether it conforms to the preset network topology detection behavior features, thereby further confirming whether the message may be a malicious detection behavior.

[0281] S705: Determine whether there is a network topology detection behavior feature.

[0282] Specifically, topology detection messages of different protocols have their own corresponding network topology detection behavior characteristics; if the message has the corresponding network topology detection behavior characteristics, execute step S706; if the message does not have the corresponding network topology detection behavior characteristics, execute step S707.

[0283] S706: Determine the message as a topology detection message.

[0284] Specifically, if the message has the corresponding network topology detection behavior feature, it means that the message belongs to the topology detection message of the topology detection behavior, and step S708 needs to be executed to generate a fake response message of the virtual topology structure.

[0285] S707, a response message is returned from the real network.

[0286] Specifically, when the message does not have the corresponding network topology detection behavior feature, or is a trusted message, a response message can be normally returned from the real network.

[0287] S708: Match the associated virtual node in the virtual topology structure based on the target address of the topology detection message.

[0288] Specifically, first, according to the target address (such as IP address and port number) in the topology detection message, a virtual node corresponding to the target address is found in the virtual topology structure. This virtual node is the associated virtual node, which is a node initially selected in the virtual topology according to the target address. It is not a node in the real network, but a virtual node used to confuse the detector.

[0289] It should be noted that the virtual topology structure in step S708 is generated based on the network topology structure in the network topology structure library. The specific process includes:

[0290] S731, obtaining network topology data of various network environment types.

[0291] S732, generating a plurality of network topology structures based on the network topology data and the input configuration information.

[0292] S733, storing the generated network topology structure in a network topology structure library.

[0293] S734, specifying the network topology structure of the network topology structure library to generate a virtual topology structure.

[0294] First, the system obtains network topology data from various types of network environments, and generates various network topologies based on these network topology data and the configuration information entered by the user or system administrator; then, the generated network topologies are stored in the network topology library; finally, one or more network topologies are specified from the network topology library to further generate virtual topologies. This ensures that the virtual topology can effectively simulate various real network environments for testing and protecting network security.

[0295] S709: Determine whether the TTL value of the topology detection message reaches a preset TTL value corresponding to the associated virtual node.

[0296] Specifically, by comparing the actual TTL value of the topology detection message with the preset TTL value corresponding to the associated virtual node, it can be determined whether the data packet of the topology detection message can reach the associated virtual node. If the TTL value of the topology detection message is greater than or equal to the preset TTL value of the associated virtual node, it means that the data packet of the topology detection message can reach the associated virtual node, and step S710 is executed; if the TTL value of the topology detection message is less than the preset TTL value of the associated virtual node, it means that the data packet of the topology detection message cannot reach the associated virtual node, and step S711 is executed.

[0297] S710: Use the associated virtual node as the target virtual node.

[0298] Specifically, if the TTL value of the topology detection message is greater than or equal to the preset TTL value of the associated virtual node, it means that the data packet of the topology detection message can reach the associated virtual node. This associated virtual node can be determined as the final target virtual node to generate a response message to deceive the detector.

[0299] S711: Match a target virtual node according to the TTL value of the topology detection message and the virtual topology structure.

[0300] Specifically, if the TTL value of the topology detection message is less than the preset TTL value of the associated virtual node, it means that the data packet of the topology detection message cannot reach the associated virtual node, and it is necessary to find a more suitable virtual node in the virtual topology structure according to the TTL value of the topology detection message (for example, other nodes that are more consistent with the TTL value of the topology detection message) and determine it as the final target virtual node to generate a response message to deceive the detector.

[0301] S712, generate and return a response message

[0302] Specifically, after the target virtual node is matched in the virtual topology structure based on the target information (such as the target address and TTL value) in the topology detection message, a response message will be generated and returned to the detector according to the target virtual node. The response message simulates the response of the target virtual node, which can make the detector believe that the detected node does exist in the network, and continue to speculate the network topology structure through the forged source IP address of the target virtual node. However, these speculations are based on false information, thus protecting the real network structure from being leaked.

[0303] It should be noted that in order to verify the anti-mapping capability of the target network, it is also necessary to perform a topology detection verification process by distributed detection nodes, including:

[0304] S741, using distributed detection nodes set in different network areas to perform a topology detection task on the target network.

[0305] The process of performing the topology detection task on the target network is to perform steps S701 to S712 using the messages sent by the distributed detection nodes.

[0306] S742, obtaining the detection topology structure.

[0307] Among them, the detection topology structure can be inferred based on the response message returned by the target virtual node or the real network. The detection topology structure reflects the layout and connection method of network nodes and paths from the perspective of the detector.

[0308] S743, determining whether the detected topology structure is consistent with the virtual topology structure.

[0309] If the detected topology structure is consistent with the virtual topology structure (the similarity exceeds the preset threshold), step S744 is executed; if the detected topology structure is inconsistent with the virtual topology structure (the similarity does not exceed the preset threshold), step S745 is executed.

[0310] S744, target network anti-mapping is effective.

[0311] If the detection topology is highly consistent with the virtual topology, it means that the virtual topology has successfully confused the detection behavior and the anti-mapping technology has played its due role.

[0312] S745, Target network anti-mapping is invalid.

[0313] If there is a large difference between the detected topology and the virtual topology, it means that the target network has low anti-mapping capability and needs to adjust the virtual topology or anti-mapping strategy.

[0314] Please refer to the following Figure 8 , Figure 8 A network anti-mapping device is provided as an exemplary embodiment of the present application. Figure 8 As shown, the network anti-mapping device 800 includes:

[0315] The detection module 810 is used to perform content detection on the message transmitted in the target network, identify and determine the topology detection message containing the network topology detection behavior;

[0316] The camouflage module 820 is used to match the target virtual node in the specified virtual topology structure based on the target information of the topology detection message, wherein the target information includes the target address and the TTL value;

[0317] The response module 830 is used to generate and return a response message based on the target virtual node, wherein the response message includes the forged source IP address of the target virtual node.

[0318] In some possible embodiments, the detection module 810 is specifically used for:

[0319] Check whether the source IP address of the message transmitted in the target network belongs to the whitelist;

[0320] If it is confirmed that the source IP address of the above-mentioned message does not belong to the whitelist, deep packet inspection is performed on the above-mentioned message. Based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, the topology detection message containing the network topology detection behavior is identified and determined; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0321] In some possible embodiments, the above-mentioned topology detection message includes a topology detection message based on the ICMP protocol, a topology detection message based on the UDP protocol, and a topology detection message based on the TCP protocol.

[0322] In some possible embodiments, the ICMP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0323] The data volume of the message is less than the preset data volume;

[0324] The TTL values ​​between packets with the same source IP address gradually increase;

[0325] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0326] In some possible embodiments, the UDP protocol-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0327] The port number of the destination address of the message is greater than 1024;

[0328] The TTL values ​​between packets with the same source IP address gradually increase;

[0329] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0330] In some possible embodiments, the TCP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0331] The message is a TCP SYN packet;

[0332] The port number of the destination address of the message is greater than the preset port number or belongs to the specified port number;

[0333] The TTL values ​​between packets with the same source IP address gradually increase;

[0334] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0335] In some possible embodiments, the camouflage module 820 is specifically used for:

[0336] Matching associated virtual nodes in the virtual topology structure based on the target address of the topology detection message;

[0337] Confirm whether the TTL value of the topology detection message reaches the preset TTL value corresponding to the associated virtual node;

[0338] If yes, then the above associated virtual node is used as the target virtual node;

[0339] If not, the target virtual node is matched according to the TTL value of the topology detection message and the virtual topology structure.

[0340] In some possible embodiments, the virtual topology structure is generated based on a network topology structure in a network topology structure library;

[0341] The device 800 also includes a generating module, which is specifically used to:

[0342] Obtain network topology data for various network environment types;

[0343] A variety of network topology structures are generated based on the network topology data and the input configuration information, and stored in the network topology structure library.

[0344] In some possible embodiments, the detection module 810 is specifically used to:

[0345] Check whether the source IP address of the message transmitted in the target network belongs to the blacklist;

[0346] If it is confirmed that the source IP address of the message belongs to the blacklist, the message is determined to be the topology detection message.

[0347] In some possible embodiments, the detection module 810 is further configured to:

[0348] Confirm whether the risk level of the source IP address of the above message in the above blacklist is higher than the risk threshold;

[0349] If yes, determining the message as the topology detection message;

[0350] If not, perform deep packet inspection on the above-mentioned message, and based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, identify and determine the topology detection message containing the network topology detection behavior; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0351] In some possible embodiments, the device 800 further includes a monitoring module, which is specifically configured to:

[0352] Check whether the source IP address of the topology detection message is on the blacklist.

[0353] If not, the source IP address of the topology detection message is added to the blacklist and assigned an initial risk level, the initial risk level being lower than the risk threshold;

[0354] If so, the risk level of the topology detection message in the blacklist is updated based on a preset risk rule.

[0355] In some possible embodiments, the device 800 further includes an audit module, which is specifically configured to:

[0356] Obtain network security intelligence data from multiple sources and record network traffic data of the above target networks;

[0357] Identify suspicious entities based on the above network security intelligence data and the above network traffic data;

[0358] The source IP address of the above suspicious subject is added to the blacklist. The risk level of the source IP address of the above suspicious subject is higher than the risk threshold.

[0359] In some possible embodiments, the device 800 further includes a verification module, which is specifically configured to:

[0360] Using distributed detection nodes set in different network areas to perform topology detection tasks on the target network, and obtain a detection topology structure;

[0361] The above detection topology is compared with the above virtual topology to verify the effectiveness of the above target network anti-mapping.

[0362] The division of each module in the above-mentioned network anti-mapping device is only for illustration. In other embodiments, the network anti-mapping device can be divided into different modules as needed to complete all or part of the functions of the above-mentioned network anti-mapping device. The implementation of each module in the network anti-mapping device provided in the embodiment of the present application can be in the form of a computer program. The computer program can be run on a terminal or a server. The program modules constituted by the computer program can be stored in the memory of the terminal or the server. When the computer program is executed by the processor, all or part of the steps of the network anti-mapping method described in the embodiment of the present application are implemented.

[0363] See also Fig. 9 , Fig. 9 The following is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. Fig. 9 As shown, the electronic device 900 may include: at least one processor 910, at least one communication bus 920, a user interface 930, at least one network interface 940, and a memory 950. The communication bus 920 may be used to realize the connection and communication of the above components.

[0364] The user interface 930 may include a display screen (Display) and a camera (Camera), and the optional user interface may also include a standard wired interface and a wireless interface.

[0365] The network interface 940 may optionally include a Bluetooth module, a Near Field Communication (NFC) module, a Wireless Fidelity (Wi-Fi) module, and the like.

[0366] Among them, the processor 910 may include one or more processing cores. The processor 910 uses various interfaces and lines to connect various parts within the entire electronic device 900, and executes various functions and processes data of the electronic device 900 by running or executing instructions, programs, code sets or instruction sets stored in the memory 950, and calling data stored in the memory 950. Optionally, the processor 910 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 910 can integrate one or more combinations of a processor (Central Processing Unit, CPU), a graphics processor (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 910, and it can be implemented separately through a chip.

[0367] The memory 950 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 950 includes a non-transitory computer-readable medium. The memory 950 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 950 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a detection function, a camouflage function, a response function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store data involved in the above-mentioned method embodiments, etc. The memory 950 may optionally be at least one storage device located away from the aforementioned processor 910. As Fig. 9 As shown, the memory 950 as a computer storage medium may include an operating system, a network communication module, a user interface module, and program instructions.

[0368] Specifically, the processor 910 may be used to call the program instructions stored in the memory 950, and specifically perform the following operations:

[0369] Perform content detection on the messages transmitted in the target network, identify and determine the topology detection messages containing network topology detection behavior;

[0370] Based on the target information of the topology detection message, matching the target virtual node in the specified virtual topology structure, the target information including the target address and the TTL value;

[0371] A response message is generated and returned based on the target virtual node, wherein the response message includes the forged source IP address of the target virtual node.

[0372] In some possible embodiments, when the processor 910 performs the above-mentioned content detection on the message transmitted in the target network, and identifies and determines the topology detection message containing the network topology detection behavior, it specifically further performs:

[0373] Check whether the source IP address of the message transmitted in the target network belongs to the whitelist;

[0374] If it is confirmed that the source IP address of the above-mentioned message does not belong to the whitelist, deep packet inspection is performed on the above-mentioned message. Based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, the topology detection message containing the network topology detection behavior is identified and determined; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0375] In some possible embodiments, the above-mentioned topology detection message includes a topology detection message based on the ICMP protocol, a topology detection message based on the UDP protocol, and a topology detection message based on the TCP protocol.

[0376] In some possible embodiments, the ICMP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0377] The data volume of the message is less than the preset data volume;

[0378] The TTL values ​​between packets with the same source IP address gradually increase;

[0379] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0380] In some possible embodiments, the UDP protocol-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0381] The port number of the destination address of the message is greater than 1024;

[0382] The TTL values ​​between packets with the same source IP address gradually increase;

[0383] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0384] In some possible embodiments, the TCP-based topology detection message meets one or more of the following preset network topology detection behavior characteristics:

[0385] The message is a TCP SYN packet;

[0386] The port number of the destination address of the message is greater than the preset port number or belongs to the specified port number;

[0387] The TTL values ​​between packets with the same source IP address gradually increase;

[0388] The difference between the sending intervals of the packets with the same source IP address is smaller than the preset time threshold.

[0389] In some possible embodiments, when the processor 910 executes the target information based on the topology detection message and matches the target virtual node in the specified virtual topology structure, it further specifically executes:

[0390] Matching associated virtual nodes in the virtual topology structure based on the target address of the topology detection message;

[0391] Confirm whether the TTL value of the topology detection message reaches the preset TTL value corresponding to the associated virtual node;

[0392] If yes, then the above associated virtual node is used as the target virtual node;

[0393] If not, the target virtual node is matched according to the TTL value of the topology detection message and the virtual topology structure.

[0394] In some possible embodiments, the virtual topology structure is generated based on a network topology structure in a network topology structure library;

[0395] Before executing the above matching at least one target virtual node in the specified virtual topology structure, the processor 910 further specifically executes:

[0396] Obtain network topology data for various network environment types;

[0397] A variety of network topology structures are generated based on the network topology data and the input configuration information, and stored in the network topology structure library.

[0398] In some possible embodiments, when the processor 910 performs the above-mentioned content detection on the message transmitted in the target network, and identifies and determines the topology detection message containing the network topology detection behavior, it specifically further performs:

[0399] Check whether the source IP address of the message transmitted in the target network belongs to the blacklist;

[0400] If it is confirmed that the source IP address of the message belongs to the blacklist, the message is determined to be the topology detection message.

[0401] In some possible embodiments, after executing the above-mentioned confirmation that the source IP address of the above-mentioned message belongs to the blacklist, the processor 910 further specifically executes:

[0402] Confirm whether the risk level of the source IP address of the above message in the above blacklist is higher than the risk threshold;

[0403] If yes, determining the message as the topology detection message;

[0404] If not, perform deep packet inspection on the above-mentioned message, and based on the deep packet inspection result of the above-mentioned message and the preset network topology detection behavior characteristics, identify and determine the topology detection message containing the network topology detection behavior; the data characteristics of the above-mentioned topology detection message conform to the above-mentioned preset network topology detection behavior characteristics.

[0405] In some possible embodiments, after performing the above identification and determining the topology detection message containing the network topology detection behavior, the processor 910 further specifically performs:

[0406] Check whether the source IP address of the topology detection message is on the blacklist.

[0407] If not, the source IP address of the topology detection message is added to the blacklist and assigned an initial risk level, the initial risk level being lower than the risk threshold;

[0408] If so, the risk level of the topology detection message in the blacklist is updated based on a preset risk rule.

[0409] In some possible embodiments, the processor 910 further specifically executes:

[0410] Obtain network security intelligence data from multiple sources and record network traffic data of the above target networks;

[0411] Identify suspicious entities based on the above network security intelligence data and the above network traffic data;

[0412] The source IP address of the above suspicious subject is added to the blacklist. The risk level of the source IP address of the above suspicious subject is higher than the risk threshold.

[0413] In some possible embodiments, the processor 910 further specifically executes:

[0414] Using distributed detection nodes set in different network areas to perform topology detection tasks on the target network, and obtain a detection topology structure;

[0415] The above detection topology is compared with the above virtual topology to verify the effectiveness of the above target network anti-mapping.

[0416] The embodiment of the present application also provides a computer-readable storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in the above embodiment. If the components of the above network anti-mapping device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium.

[0417] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above-mentioned computer program product includes one or more computer instructions. When the above-mentioned computer program instructions are loaded and executed on a computer, the above-mentioned process or function according to the embodiment of the present application is generated in whole or in part. The above-mentioned computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The above-mentioned computer instructions can be stored in a computer-readable storage medium or transmitted by the above-mentioned computer-readable storage medium. The above-mentioned computer instructions can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (such as coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The above-mentioned computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrated. The above-mentioned available media can be magnetic media (for example, floppy disks, hard disks, tapes), optical media (for example, digital versatile discs (DVD)), or semiconductor media (for example, solid state disks (SSD)), etc.

[0418] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0419] The embodiments described above are merely descriptions of the preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements made to the technical solutions of the present application by ordinary technicians in this field should all fall within the protection scope determined by the claims.

[0420] The above describes a specific embodiment of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims and the specification can be performed in an order different from the order in the embodiments recorded in the specification and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A network anti-mapping method, characterized in that: The method comprises: Perform content detection on the messages transmitted in the target network, identify and determine the topology detection messages containing network topology detection behavior; Matching a target virtual node in a specified virtual topology structure based on target information of the topology detection message, wherein the target information includes a target address and a TTL value; A response message is generated and returned based on the target virtual node, wherein the response message includes the forged source IP address of the target virtual node.

2. The method according to claim 1, characterized in that The performing content detection on the message transmitted in the target network to identify and determine the topology detection message containing the network topology detection behavior includes: Check whether the source IP address of the message transmitted in the target network belongs to the whitelist; If it is confirmed that the source IP address of the message does not belong to the whitelist, deep packet inspection is performed on the message, and based on the deep packet inspection result of the message and the preset network topology detection behavior characteristics, the topology detection message containing the network topology detection behavior is identified and determined; the data characteristics of the topology detection message conform to the preset network topology detection behavior characteristics.

3. The method according to claim 1, characterized in that: The matching of the target virtual node in the specified virtual topology structure based on the target information of the topology detection message includes: Matching an associated virtual node in the virtual topology structure based on a target address of the topology detection message; Confirm whether the TTL value of the topology detection message reaches the preset TTL value corresponding to the associated virtual node; If yes, taking the associated virtual node as the target virtual node; If not, the target virtual node is matched according to the TTL value of the topology detection message and the virtual topology structure.

4. The method according to claim 1, characterized in that: The performing content detection on the message transmitted in the target network to identify and determine the topology detection message containing the network topology detection behavior includes: Check whether the source IP address of the message transmitted in the target network belongs to the blacklist; If it is confirmed that the source IP address of the message belongs to the blacklist, the message is determined as the topology detection message.

5. The method according to claim 4, characterized in that After confirming that the source IP address of the message belongs to the blacklist, comprising: Determine whether the risk level of the source IP address of the message in the blacklist is higher than the risk threshold; If so, determining the message as the topology detection message; If not, perform deep packet inspection on the message, and based on the deep packet inspection result of the message and the preset network topology detection behavior characteristics, identify and determine the topology detection message containing the network topology detection behavior; the data characteristics of the topology detection message conform to the preset network topology detection behavior characteristics.

6. The method according to claim 5, characterized in that After the topology detection message containing the network topology detection behavior is identified and determined, the method further includes: Determine whether the source IP address of the topology detection message belongs to the blacklist; If not, the source IP address of the topology detection message is added to a blacklist and assigned an initial risk level, the initial risk level being lower than the risk threshold; If so, the risk level of the topology detection message in the blacklist is updated based on a preset risk rule.

7. The method according to claim 5, characterized in that The method further comprises: Obtain network security intelligence data from multiple sources and record network traffic data of the target network; Identify suspicious entities based on the network security intelligence data and the network traffic data; The source IP address of the suspicious subject is added to a blacklist, and the risk level of the source IP address of the suspicious subject is higher than a risk threshold.

8. The method according to claim 1, characterized in that The method further comprises: Utilizing distributed detection nodes arranged in different network areas to perform topology detection tasks on the target network, and obtaining a detection topology structure; The detected topology is compared with the virtual topology to verify the effectiveness of the target network's anti-mapping.

9. A network anti-mapping device, characterized in that: The device comprises: A detection module is used to perform content detection on messages transmitted in the target network, identify and determine topology detection messages containing network topology detection behavior; A camouflage module, used to match a target virtual node in a specified virtual topology structure based on target information of the topology detection message, wherein the target information includes a target address and a TTL value; A response module is used to generate and return a response message based on the target virtual node, wherein the response message includes a forged source IP address of the target virtual node.

10. An electronic device, characterized in that: include: Processor and memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method steps according to any one of claims 1 to 8.

Images