Network security monitoring system based on power plant

Abstract

The invention discloses a network security monitoring system based on a power plant, relates to the technical field of network security, and solves the technical problems that the existing network reconnaissance behavior detection capability is poor, and real-time active defense is difficult to achieve. Comprising a network configuration module, an attack detection module and a security response module, the network configuration module is used for constructing a network sentinel by using the network node online list detected by the list construction module so as to realize a network reconnaissance attack detection and trapping environment; the attack detection module is used for extracting flow characteristic data of the network communication data packet, and when the flow characteristic data is not in any normal flow characteristic data range, inputting the network communication data packet into the attack type identification model to obtain an attack type label; the network sentinel can automatically respond to the false information according to the attack type label, and introduces an attacker into the arranged false environment, so that the next attack action of the attacker can be effectively delayed or even blocked, and the network security is improved.

Description

Technical Field

[0001] The invention relates to the technical field of network security, and in particular to a network security monitoring system based on a power plant. Background Art

[0002] With the rapid development of information technology, the Internet has become an indispensable part of human production and life. While the Internet brings people fast, high-speed, novel and massive service experience, the accompanying network security issues are also becoming increasingly serious. Unlike in the past when people used malicious means such as tampering with web page content and destroying host systems to vent political demands or show off their hacking skills, in recent years, attackers tend to use more concealed, more aggressive and more harmful technologies to obtain economic and political benefits;

[0003] Existing methods generally detect network attacks through abnormal traffic analysis. Such methods often have a high false alarm rate and poor detection capabilities for concealed network reconnaissance behaviors, making it difficult to achieve real-time active defense. Attackers can circumvent security protection systems through new attack methods and disguise themselves as normal users, so they can scan and detect information in the target network without being discovered. Based on the above shortcomings, the present invention proposes a network security monitoring system based on a power plant. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a network security monitoring system based on a power plant.

[0005] To achieve the above-mentioned object, a first aspect of the present invention provides a network security monitoring system based on a power plant, comprising a list construction module, a management module, a network configuration module, a data processing module, an attack detection module and a security response module;

[0006] The list building module is used to actively detect the power plant network in real time and learn the IP addresses currently in use in the power plant network to build an online list of network nodes;

[0007] The network configuration module is used to construct a network sentinel using the online list of network nodes detected by the list construction module to implement a network reconnaissance attack detection and entrapment environment;

[0008] The data processing module is used to sample and collect network communication data packets in the power plant network according to the sampling and collection standards set by the management module, and then match the destination IP of the data packets;

[0009] If the destination IP address is the IP address used by the list building module for active detection, the data packet is determined as a response data packet of active detection, and the data packet is fed back to the list building module for learning the IP address and port distribution information currently in use in the power plant network;

[0010] Otherwise, the data packet is sent to the attack detection module for detecting network reconnaissance attack behavior;

[0011] The attack detection module is used to extract the flow characteristic data of the network communication data packet, and compare the flow characteristic data with a plurality of normal flow characteristic data ranges respectively;

[0012] When the traffic characteristic data is not within any of the normal traffic characteristic data ranges, the network communication data packet is determined to be an abnormal attack data packet. At this time, the abnormal attack data packet is input into the attack type identification model to obtain an attack type label and feed it back to the security response module;

[0013] The security response module is used to call the network sentinel configured in the power plant network, construct a false response data packet according to the attack type label, and respond to the abnormal attack data packet;

[0014] The false response data packet includes a false IP address, a false MAC address, a false operating system type and version, and a false open port.

[0015] Furthermore, the specific working steps of the list building module are as follows:

[0016] Set an active detection timer and periodically send ARP, ICMP, TCP, and UDP detection packets to detect the power plant network; receive the detection response packets sent by the data processing module, extract the MAC address, IP, and port data in the response packets, and build an online list of network nodes.

[0017] Furthermore, the traffic characteristic data includes bit rate, packet rate, TCP traffic proportion, and UDP traffic proportion; the multiple normal traffic characteristic data ranges are obtained by using an unsupervised learning algorithm to perform statistical analysis on the traffic characteristic data of network communication data packets collected within a set historical time period.

[0018] Furthermore, it also includes a model training module, which is used to obtain historical network reconnaissance data for model training, and the training is based on the LSTM neural network model to obtain an attack type recognition model;

[0019] The historical network reconnaissance data includes historical attack data, historical abnormal data and historical attack types; the historical attack data and historical abnormal data refer to historical abnormal network communication data packets.

[0020] Furthermore, the management module is used to formulate sampling and collection standards for network communication data packets according to the specific environment of users, services, key links and Internet access in the power plant network, so that the data processing module samples and collects network communication data packets according to traffic proportion, access path or time.

[0021] Furthermore, the specific working steps of the network configuration module include:

[0022] According to the unused IP addresses and port distribution information in the online list of the detected network nodes, a portion of the unused IP addresses are randomly selected to construct a network sentinel;

[0023] When an IP address changes from an unused state to a used state, it is removed from the generated network sentinel; the network sentinel is invisible to normal users but visible to attackers.

[0024] Furthermore, the network configuration module is used to configure a node number, a false IP address, a false MAC address, a false operating system type and version, a false open port, the OPTION field and TTL field of the IP header in the response data packet, the window size of the TCP header in the response data packet, and the type and arrangement order information of the option field, for each network sentinel.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The list construction module in the present invention performs topology detection and IP address learning on the power plant network by means of active detection, and can intelligently and dynamically use unused IP addresses in the network to build network sentinels. These network sentinels can detect and trap attack behaviors and have high detection accuracy; at the same time, the attack detection module is used to perform network reconnaissance attack behavior detection on network communication data packets, extract the flow characteristic data of the network communication data packets, and when the flow characteristic data is not within any of the normal flow characteristic data ranges, the network communication data packets are input into the attack type recognition model to obtain an attack type label; the network sentinel can automatically respond to false information according to the attack type label, and by introducing the attacker into the arranged false environment, it can effectively delay or even block the attacker from carrying out the next attack action, so that the defender can conduct an in-depth and complete analysis of the attack behavior in the deceptive environment, thereby improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 The system block diagram of a network security monitoring system based on a power plant according to the present invention. DETAILED DESCRIPTION

[0029] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] See also Figure 1 , the first aspect of the present invention provides a network security monitoring system based on a power plant, including a management module, a list construction module, a network configuration module, a data processing module, an attack detection module, a security response module and a model training module;

[0031] The management module is used to formulate sampling and collection standards for network communication data packets according to the specific environment of users, services, key links and Internet access in the power plant network, so that the data processing module can sample and collect network communication data packets according to the flow ratio method, access path or time method;

[0032] The list building module is used to actively detect the power plant network in real time and learn the IP addresses currently in use in the power plant network to build an online list of network nodes; the specific steps are as follows:

[0033] Set an active detection timer to periodically send ARP, ICMP, TCP, UDP and other detection packets to detect the power plant network;

[0034] Receive the detection response data packet sent by the data processing module, extract the MAC address, IP, port and other data in the response data packet, and build a network node online list; in this embodiment, the network node online list includes all the IP addresses and port distribution information used by the power plant network;

[0035] The network configuration module is used to build a network sentinel using the online list of network nodes detected by the list construction module, to implement a network reconnaissance attack detection and trapping environment, including:

[0036] According to the unused IP addresses and port distribution information in the online list of detected network nodes, a portion of unused IP addresses are randomly selected to build network sentinels;

[0037] Configure each network sentinel with information including but not limited to the node number, false IP address, false MAC address, false operating system type and version, false open port, OPTION field and TTL field of the IP header in the response data packet, window size of the TCP header in the response data packet, type and arrangement order of option fields, etc.;

[0038] When an IP address changes from unused to used (i.e., the IP address appears in the online list of network nodes), it is removed from the generated network sentinel; the network sentinel is invisible to normal users but visible to attackers;

[0039] In this embodiment, the network configuration module is also used to periodically perform dynamic transformation operations to regenerate new network sentinels;

[0040] The data processing module is used to sample and collect network communication data packets in the power plant network according to the sampling collection standards set by the management module, and then match the destination IP of the data packet;

[0041] If the destination IP address is the IP address used by the list building module for active detection, the data packet is determined as a response data packet for active detection, and the data packet is fed back to the list building module for learning the IP address currently in use in the power plant network, port distribution and other information;

[0042] Otherwise, the data packet is sent to the attack detection module to detect network reconnaissance attack behavior;

[0043] In this embodiment, the specific detection steps of the attack detection module are as follows:

[0044] Extracting traffic characteristic data of network communication data packets, the traffic characteristic data may include one or more of the following characteristic dimensions: bit rate, packet speed, TCP traffic proportion, UDP traffic proportion, etc.;

[0045] The flow characteristic data is compared with a plurality of normal flow characteristic data ranges respectively; the plurality of normal flow characteristic data ranges are obtained by statistically analyzing the flow characteristic data of network communication data packets collected within a set historical time period using an unsupervised learning algorithm;

[0046] When the traffic characteristic data is not within any normal traffic characteristic data range, the network communication data packet is determined to be an abnormal attack data packet. At this time, the abnormal attack data packet is input into the attack type recognition model to obtain an attack type label;

[0047] The attack detection module is used to feed back the attack type label to the security response module;

[0048] The security response module is used to call the network sentinel configured in the power plant network, construct a false response data packet according to the attack type label, and respond to the abnormal attack data packet; the false response data packet includes but is not limited to a false IP address, a false MAC address, a false operating system type and version, and a false open port;

[0049] In this application, no matter what form of method (including known and unknown network reconnaissance tools) the attacker uses to scan and scout the power plant network, there is a high probability that the configured network sentinel will be encountered. The network sentinel can automatically respond to false information according to the attack type label. By introducing the attacker into the arranged false environment, it does not block the intrusion attack chain, but allows the attacker to complete the attack chain in the deceptive environment, so that the defender can conduct an in-depth and complete analysis of the attack behavior in the deceptive environment;

[0050] In a possible implementation, the model training module is used to obtain historical network reconnaissance data for model training, and the training is based on the LSTM neural network model to obtain an attack type recognition model;

[0051] The historical network reconnaissance data includes historical attack data, historical anomaly data and historical attack types; the historical attack data and historical anomaly data refer to historical abnormal network communication data packets.

[0052] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0053] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security monitoring system based on a power plant, characterized in that: It includes list building module, network configuration module, data processing module, attack detection module and security response module; The list building module is used to actively detect the power plant network in real time and learn the IP addresses currently in use in the power plant network to build an online list of network nodes; The network configuration module is used to construct a network sentinel using the online list of network nodes detected by the list construction module to implement a network reconnaissance attack detection and entrapment environment; The data processing module is used to sample and collect network communication data packets in the power plant network according to the sampling and collection standards set by the management module, and then match the destination IP of the data packets; If the destination IP address is the IP address used by the list building module for active detection, the data packet is determined as a response data packet of active detection, and the data packet is fed back to the list building module for learning the IP address and port distribution information currently in use in the power plant network; Otherwise, the data packet is sent to the attack detection module for detecting network reconnaissance attack behavior; The attack detection module is used to extract the flow characteristic data of the network communication data packet, and compare the flow characteristic data with a plurality of normal flow characteristic data ranges respectively; When the traffic characteristic data is not within any of the normal traffic characteristic data ranges, the network communication data packet is determined to be an abnormal attack data packet. At this time, the abnormal attack data packet is input into the attack type identification model to obtain an attack type label and feed it back to the security response module; The security response module is used to call the network sentinel configured in the power plant network, construct a false response data packet according to the attack type label, and respond to the abnormal attack data packet; The false response data packet includes a false IP address, a false MAC address, a false operating system type and version, and a false open port.

2. A network security monitoring system based on a power plant according to claim 1, characterized in that: The specific working steps of the list construction module are as follows: Set an active detection timer and periodically send ARP, ICMP, TCP, and UDP detection packets to detect the power plant network; receive the detection response packets sent by the data processing module, extract the MAC address, IP, and port data in the response packets, and build an online list of network nodes.

3. A network security monitoring system based on a power plant according to claim 1, characterized in that: The traffic characteristic data include bit rate, packet speed, TCP traffic proportion, and UDP traffic proportion; the multiple normal traffic characteristic data ranges are obtained by using an unsupervised learning algorithm to perform statistical analysis on the traffic characteristic data of network communication data packets collected within a set historical time period.

4. A network security monitoring system based on a power plant according to claim 1, characterized in that: It also includes a model training module, which is used to obtain historical network reconnaissance data for model training, and the training is based on the LSTM neural network model to obtain an attack type recognition model; The historical network reconnaissance data includes historical attack data, historical abnormal data and historical attack types; the historical attack data and historical abnormal data refer to historical abnormal network communication data packets.

5. A network security monitoring system based on a power plant according to claim 1, characterized in that: The management module is used to formulate sampling and collection standards for network communication data packets according to the specific environment of users, services, key links and Internet access in the power plant network, so that the data processing module samples and collects network communication data packets according to the flow ratio method, access path or time method.

6. A network security monitoring system based on a power plant according to claim 1, characterized in that: The specific working steps of the network configuration module include: According to the unused IP addresses and port distribution information in the online list of the detected network nodes, a portion of the unused IP addresses are randomly selected to construct a network sentinel; When an IP address changes from an unused state to a used state, it is removed from the generated network sentinel; the network sentinel is invisible to normal users but visible to attackers.

7. A network security monitoring system based on a power plant according to claim 6, characterized in that: The network configuration module is used to configure the node number, false IP address, false MAC address, false operating system type and version, false open port, OPTION field and TTL field of the IP header in the response data packet, window size of the TCP header in the response data packet, and type and arrangement order information of the option field.

Images