Vulnerability protection method using blocking packet for blocking

Abstract

The invention discloses a vulnerability protection method using a blocking packet for blocking, which protects vulnerabilities through the blocking packet, and adopts a traffic monitoring technology to accurately shield identified vulnerability detection traffic or attack behaviors. By deploying a protection strategy on a network level, direct repair of vulnerabilities on a host is avoided, so that the complexity of system maintenance is reduced. The method ensures that the vulnerabilities cannot be scanned and utilized. Through the means, vulnerability supervision and hacker attacks are effectively handled, and closed loop of vulnerability management is realized. Meanwhile, when a malicious or abnormal connection request is detected, the system can generate a data packet with an RST mark and send the data packet to the other party of the connection, so that the connection is forcibly interrupted. The operation can effectively prevent illegal network traffic from being continuously transmitted.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability protection, and in particular to a vulnerability protection method utilizing blocking packages for blocking. Background Art

[0002] There are currently two main technical routes for vulnerability protection technology: one is based on the gateway mode, which detects all data packets entering the gateway, identifies packets with attack behaviors based on its own feature library, and blocks them; the other is based on host-based security protection measures, which prevent network attacks by real-time monitoring of whether there are vulnerabilities in itself and installing patches for the vulnerabilities in a timely manner. For some applications that do not have patches, some products can use virtual patches to block attacks. The current specific protection measures are as follows: 1. Vulnerability protection technology based on network traffic Currently, network traffic-based vulnerability protection technologies mainly include the following types: Firewall: The seven-layer firewall can detect network packets at the application layer, and prevent vulnerability attacks by matching the application layer features in the data packet with its own application feature library. Although the firewall can effectively prevent some basic attacks, its full-flow detection may have missed reports and large performance consumption.

[0003] Intrusion Detection System (IDS) and Intrusion Prevention System (IPS): Both are used to monitor and analyze network traffic to detect possible malicious activities. Similarly, their full-flow detection may have false negatives and large performance consumption, and rely on feature matching and behavioral analysis, but when faced with evolving attack methods, there may be problems with identification lags.

[0004] Security Information and Event Management System (SIEM): SIEM system centrally collects and analyzes security event logs, providing real-time monitoring and alerts. However, the performance of SIEM depends on the integrity of event data and the analysis capabilities of the system, which may cause processing delays.

[0005] 2. Host-based vulnerability protection technology Compared with network traffic-based vulnerability protection technology, host-based vulnerability protection technology has the advantages of precise protection and low resource consumption. However, with the continuous increase in the scale of information systems and the extensive application of new technologies, the development of security patches often lags behind in the face of vulnerabilities caused by the application of these new technologies, resulting in a long repair cycle or even no patches to install. Attackers can use these windows to invade, destroy or lurk in the system, posing a serious threat to the security of business systems.

[0006] By analyzing the existing network-based and host-based vulnerability protection technologies, we find that both have (1) integration difficulties: Existing vulnerability security solutions are usually independent systems that are difficult to integrate and coordinate. How to effectively integrate information from multiple aspects such as asset management, vulnerability scanning, and traffic analysis to improve protection accuracy is a major challenge currently faced. (2) Insufficient integration of assets and vulnerabilities: Although vulnerability scanning systems can detect known vulnerabilities, they lack real-time management of network assets and effective integration of vulnerability information, resulting in insufficient accuracy and pertinence of protection measures.

[0007] In order to deal with the above problems, there is an urgent need for a vulnerability management method to achieve convenient and reliable management of vulnerabilities, so that vulnerabilities cannot be exploited and the safe and stable operation of business systems is guaranteed. The blocking packet blocking method based on traffic bypass deployment provided by the present invention, combined with asset management functions and optimized vulnerability identification methods, can effectively improve the accuracy and efficiency of network security protection and fill the gaps in the existing technology. Summary of the invention

[0008] Therefore, in order to solve the above-mentioned shortcomings, the present invention provides a vulnerability protection method using blocking packet blocking, and a vulnerability protection system based on bypass deployment, which aims to improve the accuracy and efficiency of network vulnerability protection through traffic bypass deployment, asset management and optimized vulnerability identification.

[0009] The present invention is implemented by constructing a vulnerability protection method using blocking packages, including: Deploy bypass mirroring devices at key network nodes or network borders to ensure that all traffic in and out of the network can be mirrored and sent to the traffic analysis module, and mirror network traffic to the traffic analysis module; The bypass mirror device should be deployed at the key nodes of the network. The selected location should cover all traffic in and out of the network to ensure comprehensive traffic monitoring. Connect the bypass mirror device to the mirror port on the network link. Configure the mirror port to ensure that all traffic can be accurately copied and sent to the traffic analysis module. The traffic analysis module monitors and analyzes the mirrored traffic in real time to detect whether there is any exploitation of the vulnerability. The module uses deep packet inspection, behavior analysis and abnormal traffic identification technology to conduct in-depth analysis of the traffic. The module should have high-performance data processing and real-time analysis capabilities, and should support traffic monitoring and data analysis in high-traffic environments. RST blocking module: integrated into the traffic analysis module or as an independent blocking device, it communicates with the traffic analysis module in real time to ensure rapid response; when the traffic analysis module detects malicious exploitation, it sends a data packet with an RST flag to the source address to forcibly interrupt the malicious connection; in this way, it prevents attackers from exploiting vulnerabilities to carry out further attacks; Management and monitoring module: Centrally manage and monitor the operation status of the entire system, including traffic analysis results, blocking activities and system performance. Provide alarm, reporting and policy management functions; The implementation process of this method is as follows: 1) Scan the business systems that need to be protected through vulnerability scanning related systems to discover the vulnerabilities in the business systems; 2) Import the leak scan results into the vulnerability protection system; 3) The vulnerability protection system activates the corresponding protection rules; 4) The core switch configures mirrored traffic to the vulnerability protection system; 5) The vulnerability protection system analyzes the traffic in real time to see if there is malicious scanning or vulnerability attack behavior; 6) Real malicious scanning or vulnerability attacks against business systems occur; 7) The vulnerability protection system finds real malicious scanning or vulnerability attack behaviors through traffic analysis, triggers the protection rules, and immediately and automatically builds a blocking package for the corresponding behavior; 8) The vulnerability protection system (bypass deployment) sends the blocking packet to the core switch; 9) The core switch forwards the blocked packets to block malicious scanning or vulnerability attacks; 10) Block business systems and malicious scanning or vulnerability attack behavior sessions at the same time, ultimately achieving two-way blocking.

[0010] According to the vulnerability protection method using blocking packets of the present invention, it is characterized by: it also includes the following test and verification operations, in order to verify the validity of this patent, verification is carried out by carrying out relevant tests; (1) Test content: Verify whether the bypass mirroring device can accurately mirror network traffic and ensure that all traffic in and out of the network can be captured; verify whether the traffic analysis module can accurately identify vulnerability exploitation behavior and generate corresponding alarms; verify whether the RST blocking system can effectively interrupt malicious connections and prevent the vulnerability from being further exploited; Implementation steps: Conduct simulated attack tests to check the system's detection and blocking effects on vulnerability exploitation behavior; adjust configuration to optimize performance; (2) Test content: Test the system's performance in a high-traffic environment, including traffic handling capacity, latency, and stability; Implementation steps: Conduct load testing and stress testing to ensure that the system can operate stably in an actual network environment; When the network traffic exceeds the processing capacity of the mirror port, the vulnerability protection system will inevitably not be able to receive the network traffic and will not be able to identify the attack traffic in the network. Therefore, it is very necessary to test the traffic performance to understand the overall network traffic, select the optimal deployment plan, and effectively block network attacks.

[0011] According to the present invention, a vulnerability protection method using blocking packages is characterized by: further comprising the following deployment target operation; (1) Vulnerability management closed-loop function: One of the goals of the architecture of this patent is to achieve a closed loop of vulnerability management and strengthen network security protection by shielding instead of repairing. Specific measures include: Vulnerability shielding: Based on traffic monitoring technology, targeted shielding of identified vulnerability attack traffic is performed. By implementing protection measures at the network layer, actual vulnerability repairs on the host are avoided, reducing the complexity of system maintenance; Virtual patch: A strong defensive patch is virtually applied to the host, making the vulnerability unscannable and unexploitable. In this way, vulnerability supervision and hacker attacks can be effectively dealt with, thus achieving a closed loop of vulnerability management. (2) Providing operational efficiency: The measures are designed to reduce the workload of staff and improve the efficiency of safety operations. Specific measures include: Easy deployment: You only need to access the mirrored traffic to shield the vulnerabilities of the entire network, without being limited to a single host.

[0012] Minimum business impact: Bypass mirroring ensures that traffic analysis and blocking operations will not interfere with the normal transmission of business data; Through the above implementation plan, the technical architecture can effectively improve network security protection capabilities, achieve a closed-loop vulnerability management system, and reduce the workload of vulnerability repair, providing comprehensive and efficient protection for enterprise networks.

[0013] The present invention has the following advantages: This patent protects against vulnerabilities by blocking packets and has the following innovations.

[0014] 1. Use traffic monitoring technology to accurately block identified vulnerability detection traffic or attack behaviors. By deploying protection strategies at the network level, avoid directly repairing vulnerabilities on the host, thereby reducing the complexity of system maintenance. This method ensures that vulnerabilities cannot be scanned and exploited. Through this means, we can effectively respond to vulnerability supervision and hacker attacks and achieve a closed loop of vulnerability management.

[0015] 2. When a malicious or abnormal connection request is detected, the system will generate a data packet with an RST flag and send it to the other party of the connection to forcibly terminate the connection. This operation can effectively prevent illegal network traffic from continuing to transmit.

[0016] 3. The RST blocking function can quickly interrupt malicious connections, thereby preventing potential attacks from continuing. This is particularly effective for defending against malicious detection, vulnerability exploitation attacks, and some intranet attacks. By actively blocking malicious connections, RST blocking can significantly reduce the possibility of successful attacks and protect key assets and systems in the network.

[0017] 4. The system automatically imports vulnerability data from a variety of vulnerability scanning systems, asset management systems, and other information sources. By developing standardized data interfaces and formats, the timeliness and accuracy of vulnerability information are ensured. In addition, the automatic synchronization mechanism of data effectively avoids errors and information lags that may occur during manual entry, significantly improving data processing efficiency. The function of updating vulnerability information in real time ensures that the vulnerability management system can quickly identify and handle newly discovered vulnerabilities. The unified data import interface simplifies the data integration process and enhances the compatibility and scalability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a schematic diagram of the deployment scheme of the vulnerability protection system using blocking packages; Figure 2 It is a schematic diagram of the implementation process of the vulnerability protection system using blocking packets. DETAILED DESCRIPTION

[0019] The following will be combined with the attached Figure 1-Figure 2 The present invention is described in detail, and the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] As the scale and number of information systems continue to increase, network security management faces many challenges, especially in dealing with and responding to various network security threats and vulnerabilities. The network environment of current information systems is complex, but the requirements for network security are extremely high. However, existing network security protection measures are often unable to fully address new threats and practical problems in vulnerability management. The present invention proposes a new vulnerability management technology by conducting in-depth research on the pain points of network security management and protection technologies, and combining them with current actual conditions. This technology aims to supplement and improve the deficiencies in existing security monitoring and management mechanisms by building a complete unified security vulnerability management and control system, thereby optimizing and improving the existing vulnerability security operation management capabilities.

[0021] The core of this technical solution is to invent a vulnerability protection method that uses blocking packets to block vulnerabilities, integrate and optimize existing security monitoring and management mechanisms, and provide a comprehensive and efficient vulnerability management solution. The specific technical solution is as follows: 1. Sorting and integration of vulnerability data Functional description: This solution supports automatic import of vulnerability data from different vulnerability scanning systems, asset management systems and other information sources. By formulating standardized data interfaces and formats, the timeliness and accuracy of vulnerability information can be ensured. At the same time, through the automatic synchronization of data, errors and delays in manual data entry can be avoided, and the efficiency of data processing can be improved.

[0022] Implementation effect: Real-time acquisition of the latest vulnerability information ensures that the vulnerability management system can identify and handle new vulnerabilities in a timely manner. Through a unified data import interface, the data integration process is simplified and the system's compatibility and scalability are improved.

[0023] 2. Layered detection technology Functional description: First layer: Operating system identification: The protection device first identifies the operating system information in the data packet. By analyzing the packet header and related information, the operating system type of the target device of the data packet is determined; Second layer: Vulnerability identification: After determining the target operating system, the protection device focuses on the specific vulnerabilities existing in the operating system for further identification based on the results of the known vulnerability database or vulnerability scanning system; For cross-platform application layer vulnerabilities, separate detection is performed after the first layer is identified.

[0024] Implementation effect: Reduce the detection scope: Through layered detection, the protection device will focus on the identification of specific operating systems and their vulnerabilities, avoiding the comprehensive scanning of all data packets and reducing the detection burden; Improve detection efficiency: The layered detection method can identify vulnerabilities in the target operating system faster and more accurately, improving the overall detection efficiency.

[0025] 3. Blocking package blocking Functional description: Traffic analysis: When a malicious or abnormal connection request is detected, the protection device generates a data packet with an RST flag and sends it to the other party of the connection to forcibly terminate the connection. This operation can effectively prevent illegal network traffic from continuing to transmit.

[0026] Implementation effect: Block malicious activities: RST blocking function can quickly interrupt malicious connections and prevent potential attacks from continuing. This is particularly effective for defending against TCP connection hijacking, DoS attacks and some intranet attacks; Reduce the success rate of attacks: By actively blocking malicious connections, RST blocking can significantly reduce the possibility of successful attacks and protect key assets and systems in the network.

[0027] 4. Real-time alerts Function description: Configure real-time alarm mechanism to monitor and analyze potential attack behaviors in network traffic. When abnormal behaviors related to known vulnerabilities are detected, the system can generate alarms immediately and automatically intercept measures using the blocking packet blocking function.

[0028] Implementation effect: Achieve rapid response and processing of network security threats, reduce the risk of successful attacks; improve system security and stability, and ensure the continued security of the civil aviation network environment.

[0029] Through the implementation of this technical solution, a complete unified security vulnerability management system will be effectively established, from the import of vulnerability data, intelligent analysis, policy management to real-time alarm interception, forming a complete vulnerability security protection system. This system not only solves the problems of information islands and delayed response in traditional vulnerability management, but also significantly improves the accuracy and efficiency of vulnerability management, thereby ensuring continuous security.

[0030] The following is a detailed description of this patent in conjunction with the accompanying drawings; the overall architecture of the vulnerability protection technology proposed in this application based on bypass deployment, traffic identification and packet blocking is as follows Figure 1 As shown; 1. Deployment plan: (1) Bypass mirror device At key network nodes or network boundaries, such as between switches and routers. Its role is to ensure that all traffic in and out of the network can be mirrored and sent to the traffic analysis module, and mirror network traffic to the traffic analysis module. These devices are usually deployed in the bypass of the network link and will not interfere with network traffic.

[0031] The bypass mirror device should be deployed at the key nodes of the network. The selected location should cover all traffic in and out of the network to ensure comprehensive traffic monitoring. Connect the bypass mirror device to the mirror port on the network link. Configure the mirror port to ensure that all traffic can be accurately copied and sent to the traffic analysis module.

[0032] (2) Traffic analysis module Monitor and analyze mirror traffic in real time to detect whether there is any exploitation of vulnerabilities. This module uses deep packet inspection, behavior analysis, and abnormal traffic identification technology to deeply analyze traffic. This module should have high-performance data processing and real-time analysis capabilities, and should support traffic monitoring and data analysis in high-traffic environments.

[0033] (3) RST blocking module Integrated in the traffic analysis module or as an independent blocking device, it communicates with the traffic analysis module in real time to ensure a quick response. When the traffic analysis module detects malicious exploitation, it sends a packet with an RST flag to the source address to forcibly interrupt the malicious connection. In this way, it prevents attackers from exploiting vulnerabilities to carry out further attacks.

[0034] (4) Management and monitoring module: Centrally manage and monitor the operation status of the entire system, including traffic analysis results, blocking activities and system performance. Provide alarm, reporting and policy management functions.

[0035] 2. Testing and verification: To verify the validity of this patent, relevant tests are carried out to verify (1) Test content: Verify whether the bypass mirror device can accurately mirror network traffic and ensure that all traffic in and out of the network can be captured; verify whether the traffic analysis module can accurately identify vulnerability exploitation behavior and generate corresponding alarms; verify whether the RST blocking system can effectively interrupt malicious connections and prevent the vulnerability from being further exploited. Implementation steps: Conduct simulated attack tests to check the system's detection and blocking effects on vulnerability exploitation behavior. Adjust configuration to optimize performance.

[0036] (2) Test content: Test the performance of the system in a high-traffic environment, including traffic handling capacity, latency, and stability. Implementation steps: Perform load testing and stress testing to ensure that the system can operate stably in an actual network environment.

[0037] When the network traffic exceeds the processing capacity of the mirror port, the vulnerability protection system will inevitably not be able to receive the network traffic and will not be able to identify the attack traffic in the network. Therefore, it is very necessary to test the traffic performance to understand the overall network traffic, select the optimal deployment plan, and effectively block network attacks.

[0038] 3. Deployment goals: (1) Vulnerability management closed-loop function One of the goals of this patented architecture is to achieve a closed loop of vulnerability management and strengthen network security protection by shielding instead of repairing. Specific measures include: Vulnerability shielding: Based on traffic monitoring technology, targeted shielding is performed on identified vulnerability attack traffic. By implementing protection measures at the network layer, actual vulnerability repairs on the host are avoided, reducing the complexity of system maintenance.

[0039] Virtual patch: Virtually apply a strong defensive patch to the host, making the vulnerability unscannable and unexploitable. In this way, vulnerability supervision and hacker attacks can be effectively dealt with, thus achieving a closed loop of vulnerability management.

[0040] (2) Improving operational efficiency This patent aims to reduce the workload of staff and improve the efficiency of safety operations. Specific measures include: Easy deployment: You only need to access the mirrored traffic to shield the vulnerabilities of the entire network, without being limited to a single host.

[0041] Minimum business impact: Bypass mirroring ensures that traffic analysis and blocking operations do not interfere with the normal transmission of business data.

[0042] Through the above implementation plan, the technical architecture can effectively improve network security protection capabilities, achieve a closed-loop vulnerability management system, and reduce the workload of vulnerability repair, providing comprehensive and efficient protection for enterprise networks.

[0043] like Figure 2 The following is a schematic diagram of the implementation process of this application. The specific implementation process is as follows: 1) Scan the business systems that need to be protected through vulnerability scanning related systems to discover the vulnerabilities in the business systems; 2) Import the leak scan results into the vulnerability protection system; 3) The vulnerability protection system activates the corresponding protection rules; 4) The core switch configures mirrored traffic to the vulnerability protection system; 5) The vulnerability protection system analyzes the traffic in real time to see if there is malicious scanning or vulnerability attack behavior; 6) Real malicious scanning or vulnerability attacks against business systems occur; 7) The vulnerability protection system finds real malicious scanning or vulnerability attack behaviors through traffic analysis, triggers the protection rules, and immediately and automatically builds a blocking package for the corresponding behavior; 8) The vulnerability protection system (bypass deployment) sends the blocking packet to the core switch; 9) The core switch forwards the blocked packets to block malicious scanning or vulnerability attacks; 10) Block business systems and malicious scanning or vulnerability attack behavior sessions at the same time, ultimately achieving two-way blocking.

[0044] The advantages of this patent are described below: This patent protects against vulnerabilities by blocking packets and has the following advantages.

[0045] 1. Easy deployment: This patent adopts a bypass deployment method, which does not affect the original network architecture and achieves vulnerability protection while ensuring network stability.

[0046] 2. Reduce the success rate of attacks: By implementing blocking at the network level, this patent can effectively reduce the probability of successful attacks. Attackers cannot continue to exploit identified vulnerabilities, reducing the threat to the network and host.

[0047] 3. Improve response speed: Through automated traffic analysis and blocking mechanisms, this patent can respond to network threats in real time, reduce manual intervention and response time, and improve the overall security protection capabilities of the network.

[0048] 4. Improve operation and maintenance efficiency: It provides a centralized management platform to facilitate operation and maintenance personnel to perform system management, policy configuration and performance monitoring, thereby improving operation and maintenance efficiency and management convenience.

[0049] This patent protects against vulnerabilities by blocking packets and has the following innovations.

[0050] 1. Use traffic monitoring technology to accurately block identified vulnerability detection traffic or attack behaviors. By deploying protection strategies at the network level, it is possible to avoid directly fixing vulnerabilities on the host, thereby reducing the complexity of system maintenance. This method ensures that vulnerabilities cannot be scanned and exploited. Through this means, vulnerability supervision and hacker attacks can be effectively responded to, and a closed loop of vulnerability management can be achieved.

[0051] 2. When a malicious or abnormal connection request is detected, the system will generate a data packet with an RST flag and send it to the other party of the connection to forcibly terminate the connection. This operation can effectively prevent illegal network traffic from continuing to be transmitted.

[0052] 3. The RST blocking function can quickly interrupt malicious connections, thereby preventing potential attacks from continuing. This is particularly effective for defending against malicious detection, vulnerability exploitation attacks, and some intranet attacks. By actively blocking malicious connections, RST blocking can significantly reduce the possibility of successful attacks and protect key assets and systems in the network.

[0053] 4. The system automatically imports vulnerability data from a variety of vulnerability scanning systems, asset management systems, and other information sources. By developing standardized data interfaces and formats, the timeliness and accuracy of vulnerability information are ensured. In addition, the automatic data synchronization mechanism effectively avoids errors and information lags that may occur during manual entry, significantly improving data processing efficiency. The function of updating vulnerability information in real time ensures that the vulnerability management system can quickly identify and handle newly discovered vulnerabilities. The unified data import interface simplifies the data integration process and enhances the compatibility and scalability of the system.

[0054] After searching, the patent "Attack Path Analysis Method and Device Based on Vulnerability Exploitation and State Transition" (application number: CN118473702A) discloses that the present invention provides an attack path analysis method and device based on vulnerability exploitation and state transition, which relates to the field of network security technology. The method includes: determining the attack progress, exploitable vulnerabilities, and exploitable device nodes corresponding to the exploitable vulnerabilities according to the vulnerability scanning information obtained by the previous scan, and creating a state transition model; according to the attack progress, determining that the current attack device node is being exploited, the next exploitable device node determined based on the state transition model is not scanned by the system security self-check, and determining to use the next exploitable device node as the attack path for state transition. However, the present invention determines the attack progress, exploitable vulnerabilities, and exploitable device nodes corresponding to the exploitable vulnerabilities based on the vulnerability scanning information obtained by daily security inspection on the basis of the security protection strategy, and creates a state transition model, thereby combining defense and attack to analyze the attack path, thereby improving the accuracy of attack path analysis. The patent also realizes the association with the vulnerability scanning system, but does not realize the blocking of vulnerability attacks, and the targets are also inconsistent.

[0055] This proposal not only realizes the association with the vulnerability scanning system, but also adopts bypass deployment and combines the blocking package method to realize the detection and blocking of vulnerability attacks.

[0056] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A vulnerability protection method using blocking packets, characterized in that; include; Deploy bypass mirroring devices at key network nodes or network borders to ensure that all traffic in and out of the network can be mirrored and sent to the traffic analysis module, and mirror network traffic to the traffic analysis module; Bypass mirror devices should be deployed at key nodes of the network. The selected locations should cover all traffic in and out of the network to ensure comprehensive traffic monitoring. Connect the bypass mirror device to the mirror port on the network link; Configure mirror ports to ensure that all traffic can be accurately copied and sent to the traffic analysis module; The traffic analysis module monitors and analyzes the mirrored traffic in real time to detect whether there is any behavior that exploits the vulnerability; This module uses deep packet inspection, behavioral analysis, and abnormal traffic identification technology to deeply analyze traffic; The module should have high-performance data processing and real-time analysis capabilities, and should support traffic monitoring and data analysis in high-traffic environments; RST blocking module: integrated into the traffic analysis module or as an independent blocking device, it communicates with the traffic analysis module in real time to ensure rapid response; when the traffic analysis module detects malicious exploitation, it sends a data packet with an RST flag to the source address to forcibly interrupt the malicious connection; in this way, it prevents attackers from exploiting vulnerabilities to carry out further attacks; Management and monitoring module: Centrally manage and monitor the operation status of the entire system, including traffic analysis results, blocking activities and system performance; provide alarm, reporting and policy management functions; The implementation process of this method is as follows: 1) Scan the business systems that need to be protected through vulnerability scanning related systems to discover the vulnerabilities in the business systems; 2) Import the leak scan results into the vulnerability protection system; 3) The vulnerability protection system activates the corresponding protection rules; 4) The core switch configures mirrored traffic to the vulnerability protection system; 5) The vulnerability protection system analyzes the traffic in real time to see if there is malicious scanning or vulnerability attack behavior; 6) Real malicious scanning or vulnerability attacks against business systems occur; 7) The vulnerability protection system finds real malicious scanning or vulnerability attack behaviors through traffic analysis, triggers the protection rules, and immediately and automatically builds a blocking package for the corresponding behavior; 8) The vulnerability protection system (bypass deployment) sends the blocking packet to the core switch; 9) The core switch forwards the blocked packets to block malicious scanning or vulnerability attacks; 10) Block business systems and malicious scanning or vulnerability attack behavior sessions at the same time, ultimately achieving two-way blocking.

2. According to claim 1, a vulnerability protection method using blocking packets is characterized in that; It also includes the following testing and verification operations, in order to verify the validity of this patent, by conducting relevant tests for verification; (1) Test content: Verify whether the bypass mirroring device can accurately mirror network traffic and ensure that all traffic in and out of the network can be captured; Verify whether the traffic analysis module can accurately identify vulnerability exploitation behavior and generate corresponding alarms; verify whether the RST blocking system can effectively interrupt malicious connections and prevent the vulnerability from being further exploited; implementation steps: conduct simulated attack tests to check the system's detection and blocking effects on vulnerability exploitation behavior; adjust configuration to optimize performance; (2) Test content: Test the system's performance in a high-traffic environment, including traffic handling capacity, latency, and stability; Implementation steps: Conduct load testing and stress testing to ensure that the system can operate stably in an actual network environment; When the network traffic exceeds the processing capacity of the mirror port, the vulnerability protection system will inevitably not be able to receive the network traffic and will not be able to identify the attack traffic in the network. Therefore, it is very necessary to test the traffic performance to understand the overall network traffic, select the optimal deployment plan, and effectively block network attacks.

3. According to claim 1, a vulnerability protection method using blocking packets is characterized in that; It also includes the following deployment target operations; (1) Vulnerability management closed-loop function: One of the goals of the architecture of this patent is to achieve a closed loop of vulnerability management and strengthen network security protection by blocking instead of repairing. Specific measures include: Vulnerability shielding: Based on traffic monitoring technology, targeted shielding of identified vulnerability attack traffic is performed; by implementing protection measures at the network layer, actual vulnerability repairs on the host are avoided, reducing the complexity of system maintenance; Virtual patch: A strong defensive patch is virtually applied to the host, making the vulnerability unscannable and unexploitable. In this way, vulnerability supervision and hacker attacks can be effectively dealt with, thus achieving a closed loop of vulnerability management. (2) Providing operational efficiency: The measures are designed to reduce the workload of staff and improve the efficiency of safety operations. Specific measures include: Easy deployment: Simply connect to the mirrored traffic to shield the entire network from vulnerabilities, without being limited to a single host. Minimum business impact: Bypass mirroring ensures that traffic analysis and blocking operations will not interfere with the normal transmission of business data; Through the above implementation plan, the technical architecture can effectively improve network security protection capabilities, achieve a closed-loop vulnerability management system, and reduce the workload of vulnerability repair, providing comprehensive and efficient protection for enterprise networks.

Images