Port scanning monitoring method and system based on domestic server

Abstract

The invention relates to the technical field of network security, and discloses a port scanning monitoring method and system based on a localized server, and the method comprises the steps: a management end configures parameters and executes an action; the client collects real-time network connection information and obtains a port state; and comparing the parameter information with the network connection information, triggering an execution action and generating an alarm log. According to the method provided by the invention, the port scanning monitoring method is realized in a localized server environment, so that the real-time monitoring and control capability on network connection and port states is effectively improved. Through parameter configuration of the management end and hierarchical response of the data acquisition and analysis module of the client, the system can quickly identify and deal with abnormal connection and port scanning behaviors. Meanwhile, a long-time window detection strategy enables the system to accurately distinguish short-term fluctuation and persistent abnormity, so that misjudgment is reduced, and the alarm accuracy is improved. The overall design enhances the network security and the system stability, and is suitable for a localized server application scene with a high security requirement.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a port scanning monitoring method and system based on a domestic server. Background Art

[0002] In recent years, with the rapid development of information technology and network security needs, port scanning detection technology has gradually become an important part of the network protection system. Port scanning is an important part of the attacker's network attack in which he determines the open network services of the target host through the system port information. To prevent this security risk, traditional port scanning detection technology usually relies on rule-based strategies and traffic analysis technology, and mainly runs on foreign mainstream server environments. However, with the advancement of the localization of information systems, more and more enterprises and institutions use domestic servers and domestic operating systems, and traditional port scanning detection technology has exposed many deficiencies in adaptability and compatibility. For example, port scanning tools and methods based on specific operating systems are difficult to directly migrate to domestic server environments, and these tools also have problems such as reduced detection accuracy and efficiency when adapting to the localized environment. In addition, traditional port scanning detection mostly adopts C / S architecture. Although it has a certain degree of independence, it is difficult to meet the real-time and centralized management requirements in complex network environments.

[0003] However, the existing related technologies still have many shortcomings in port scanning monitoring for domestic server environments. First, due to the differences between domestic server architectures and traditional foreign servers in the underlying hardware and system interfaces, the adaptation of existing port scanning tools is more difficult, and has an adverse effect on monitoring speed and accuracy. Secondly, traditional port scanning methods are mostly passive defense methods, mainly relying on traffic collection and post-analysis, which are difficult to meet the needs of real-time detection and response, and lack flexible configuration management and unified control methods in dealing with high-frequency port scanning activities, resulting in a relatively rigid defense mechanism. Especially in terms of centralized management, traditional port scanning technology is difficult to achieve flexible configuration and centralized alarm management for different server environments and network topologies. Therefore, in actual applications, security risks caused by untimely defense often occur. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is that the existing port scanning monitoring is mainly monitored and blocked through network firewalls. This monitoring method has a large granularity and can only monitor scanning behaviors from the outside, but cannot effectively monitor and block scanning behaviors between the same network segments.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a port scanning monitoring method based on a domestic server, comprising: the management end configures parameters and executes actions; the client collects real-time network connection information and obtains the port status; compares parameter information and network connection information, triggers execution actions and generates alarm logs.

[0007] As a preferred solution of the port scanning monitoring method based on a domestic server described in the present invention, after the management end configures the parameters and executes the action, it also includes synchronizing the configured parameter information with the client through the network security protocol, and after the client receives the parameter information, it writes the information into a local file.

[0008] As a preferred solution of the port scanning monitoring method based on a domestic server described in the present invention, the client collects real-time network connection information and obtains the port status, including that the client performs real-time data collection of network connection and port status through capture tools and port monitoring technology.

[0009] As a preferred solution of the port scanning monitoring method based on the domestic server described in the present invention, wherein: the comparison of parameter information and network connection information includes, the client generates a monitoring control table according to the received parameter information, compares the real-time network connection information and the monitoring control table, obtains a first result, and determines the triggering of the execution action according to the first result.

[0010] As a preferred solution of the port scanning monitoring method based on a domestic server described in the present invention, wherein: the trigger for determining the execution of an action based on the first result includes comparing the first interval, the second interval and the third interval preset in the monitoring control table with the first result; the action includes no action, the first action and the second action; the trigger includes, when the first result belongs to the first interval, executing no action; when the first result belongs to the second interval, executing the first action and recording the duration, when there is a source IP that triggers the first action for a long time, or the number of times the first action is triggered exceeds a preset threshold, executing the second action; when the first result belongs to the third interval, executing the second action.

[0011] As a preferred solution of the port scanning monitoring method based on a domestic server described in the present invention, wherein: the capture tool includes but is not limited to a network card driver hook and a network packet capture library; the port monitoring technology includes but is not limited to calling commands and APIs.

[0012] As a preferred solution of the port scanning monitoring method based on a domestic server described in the present invention, wherein: the client performs real-time data collection of network connection and port status through capture tools and port monitoring technology, including: the client obtains network connection information in real time through the network card driver hook, records all incoming and outgoing connections and their status, including but not limited to source IP, target IP, port and protocol information; through the internal command netstat-tuln, regularly checks the open status of the port, and records the open, closed or filtered status.

[0013] A port scanning monitoring system based on a domestic server adopting any of the methods described in the present invention, wherein: a management module is used for configuration and execution action settings of a management end, receives data from a data acquisition module and an analysis control module and generates an alarm log; a data acquisition module is used for real-time collection of network connection information and port status; an analysis control module is used for analyzing and processing the collected data, comparing the parameters configured by the management end with the collected real-time network connection information, and triggering the execution action.

[0014] A computer device comprises: a memory and a processor; the memory stores a computer program, comprising: the steps of implementing any one of the methods of the present invention when the processor executes the computer program.

[0015] A computer-readable storage medium stores a computer program, comprising: when the computer program is executed by a processor, the steps of implementing any one of the methods of the present invention are implemented.

[0016] Beneficial effects of the present invention: The method of the present invention effectively improves the real-time monitoring and control capabilities of network connections and port status by implementing a port scanning monitoring method in a domestic server environment. Through the parameter configuration of the management end, the data acquisition of the client, and the hierarchical response of the analysis module, the system can quickly identify and respond to abnormal connections and port scanning behaviors. At the same time, the long-term window detection strategy enables the system to accurately distinguish between short-term fluctuations and persistent anomalies, thereby reducing misjudgments and improving alarm accuracy. The overall design enhances network security and system stability, and is suitable for domestic server application scenarios with high security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0018] Figure 1An overall flow chart of a port scanning monitoring method based on a domestic server provided by an embodiment of the present invention;

[0019] Figure 2 An overall system structure diagram of a port scanning monitoring method based on a domestic server provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0021] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a port scanning monitoring method based on a domestic server, comprising:

[0022] S1: The management side configures parameters and performs actions.

[0023] Furthermore, the key parameters of network monitoring are set on the management side, including specifying the ports to be monitored, time windows, alarm thresholds, and execution actions. Specifically, the management side defines the judgment criteria for abnormal connections (such as the upper limit of the number of connections for a single source IP within a specified time) by setting alarm thresholds, and selects corresponding execution actions to deal with abnormal situations.

[0024] Execution actions include but are not limited to blocking and auditing only: if configured to block, abnormal connection data packets will be automatically discarded when the connection triggers the alarm threshold; if configured to audit only, the system will record abnormal information without blocking the connection, which is convenient for subsequent analysis and log review.

[0025] Furthermore, after the configuration is completed, the management end securely transmits the configuration information to the client through the HTTPS protocol. The HTTPS protocol ensures that the data is encrypted during transmission to prevent the configuration content from being stolen or tampered with by a third party.

[0026] After receiving the configuration information, the client automatically writes the parameters into a local file for storage. The stored configuration information provides a basis for subsequent data collection, monitoring, and judgment, ensuring that the scheduled monitoring operations can be completed based on the local file in extreme situations such as network or power outages.

[0027] S2: The client collects real-time network connection information and obtains port status.

[0028] Furthermore, the client performs real-time data collection of network connection and port status through capture tools and port monitoring technology. The capture tools include but are not limited to network card driver hooks and network packet capture libraries; the port monitoring technology includes but is not limited to call commands and APIs.

[0029] In one embodiment of the present invention, the client implements real-time monitoring through a network card driver hook. Specifically, the network card driver hook is directly integrated into the network card driver program, and can effectively capture all connection data packets entering and leaving the system network.

[0030] Through this hook mechanism, the client can record various connection parameters in real time, including source IP address, destination IP address, source port, destination port and the protocol type used (such as TCP, UDP). This low-level capture method ensures the integrity and real-time nature of information collection, and is particularly suitable for identifying potential abnormal connection behaviors.

[0031] In addition, the client periodically uses the system internal command (such as netstat -tuln) to check the port status.

[0032] The netstat command lists all ports that are listening, open, or filtered, and records their current status. The client compares the results of each check with the previous results and records the port status changes (such as from open to closed, from listening to filtered). This data is continuously stored and updated to help identify potential threats such as ports being frequently scanned, abnormally opened or closed, etc., to facilitate subsequent risk analysis and response decisions.

[0033] In another embodiment of the present invention, the capture tool may also be a network packet capture library, which is suitable for environments that require cross-platform support or do not have driver development conditions, and is widely compatible with Linux and Windows systems.

[0034] Specifically, after installing the corresponding packet capture library on the system, call the library's initialization function to open the specified network interface. Use the pcap_loop() or pcap_next_ex() function to capture real-time incoming and outgoing data packets, including source IP, destination IP, source port, destination port, and protocol type, parse the data packet header, extract key information, and record relevant data of the network connection in real time.

[0035] Use the state detection function of the capture library to regularly check the open and closed status of the port. You can infer the status of the port by detecting the type and content changes of the connection data packet. At the same time, the network packet capture library can be combined with system commands (such as netstat) to perform more detailed port status monitoring. The capture library is responsible for collecting inbound and outbound connection traffic, and the system command is used to periodically scan the current listening port. Combining the information of the two can comprehensively determine the open, closed or filtered status of the port.

[0036] In another embodiment of the present invention, the port monitoring technology can also be an API. Compared with the internal command netstat-tuln, the API can be applied in a restricted system (for example, considering security and resource management, command calls are disabled).

[0037] Specifically, on Windows systems, use the IPHelper API library to call the relevant API to obtain the port status, and on Linux systems, directly read the network port information file in the / proc file system. Taking the Windows environment as an example, the specific steps include:

[0038] Use the GetTcpTable function to obtain the current TCP connection information from the kernel, including the local port, remote port, and connection status;

[0039] Use the GetUdpTable function to obtain the UDP port status, which also includes the local port, remote port, and connection status;

[0040] Traverse the information in the tcpTable or udpTable structure and extract the open, closed or filtered status of each port, as well as its corresponding source and destination IP.

[0041] S3: Compare parameter information and network connection information, trigger execution actions and generate alarm logs.

[0042] Furthermore, the client generates a monitoring control table according to the received parameter information, compares the real-time network connection information with the monitoring control table, obtains a first result, and determines the triggering of the execution action according to the first result.

[0043] The first interval, the second interval and the third interval preset in the monitoring control table are compared with the first result;

[0044] The actions include no action, a first action, and a second action;

[0045] The trigger includes:

[0046] When the first result belongs to the first interval, no action is performed;

[0047] When the first result belongs to the second interval, the first action is executed and the duration is recorded. When there is a source IP that triggers the first action for a long time, or the number of times the first action is triggered exceeds a preset threshold, the second action is executed;

[0048] When the first result belongs to the third interval, a second action is performed.

[0049] The first interval, the second interval and the third interval may be continuous or discontinuous score ranges. For example, according to the score size, from small to large, they are the first interval, the second interval and the third interval. Specifically, taking the request frequency as an example, the first interval may be less than 10 connection requests per second, the second interval may be 10-50 connection requests per second, and the first interval may be more than 50 connection requests per second.

[0050] In another embodiment, the intervals may be divided according to a preset blacklist and whitelist, for example, the request source (source IP) in the blacklist is the third interval.

[0051] Comparison criteria include, but are not limited to, request frequency, request source, target port, connection duration, request pattern, traffic rate, and changes in port open status.

[0052] When the first result belongs to the first interval, the port is in a safe state and no action is taken: no excessive intervention is required and the status quo can be maintained.

[0053] When the first result belongs to the second interval, there is obvious abnormal activity in the port connection, and the first action is performed: trigger a warning and enter a stricter monitoring state; according to the configuration, perform the "audit only" or "current limiting" action to limit the number of connection requests; audit record request details and include the IP in the key monitoring scope.

[0054] When the first result belongs to the third interval, the port has serious malicious behavior or specific attack characteristics, and the second action is executed: triggering the blocking strategy, immediately discarding all data packets of the source IP and automatically blocking. If the configuration allows, the alarm mechanism can be activated to send a notification to the administrator and automatically generate an alarm log.

[0055] Furthermore, after the client collects network connection logs and port status data locally, it regularly reports these monitoring data to the central management system through the HTTPS protocol. The HTTPS protocol uses SSL / TLS encryption to ensure confidentiality and integrity during data transmission. The data reported by the client agent includes network connection logs (such as source IP, target IP, port, protocol, connection status and other detailed information) and port status (such as the list of currently open, closed or filtered ports). The reporting frequency can be configured according to actual needs (such as every minute, every 5 minutes or every hour) to balance the real-time nature of the data and the system load. After the management center receives the data reported by the client, it processes the data and forms an alarm log.

[0056] Example 2, reference Figure 2 , which is an embodiment of the present invention, provides a port scanning monitoring method based on a domestic server.

[0057] Specifically, the implementation method provided in this embodiment can be implemented through a software program. The software is developed using java and python, adopts a B / S architecture, and a management terminal is deployed in the operation and maintenance area for unified management and alarm reception.

[0058] Deploy client agents (i.e. terminal agent software) on domestic server operating systems to monitor network connections and port activities in real time, and report monitoring data to the central management system for centralized analysis and alarms.

[0059] The specific steps are as follows:

[0060] Configure the monitoring port, time, alarm threshold, and execution action (blocking or auditing only) on the management side.

[0061] The configuration information is synchronized with the client agent through the https protocol. After receiving the configuration information, the client agent writes the information to the local file.

[0062] The client agent obtains network connection information in real time through the network card driver hook, and records all incoming and outgoing connections and their status, including source IP, target IP, port, protocol and other information.

[0063] The client agent uses the internal command netstat-tuln to periodically check the open status of the port and record the open, closed, or filtered status.

[0064] The analysis module compares the number of connection requests obtained with the configured threshold (for example, the number of connection requests per second from the same source IP is greater than 20 times). If it is higher than the threshold, it is considered as abnormal scanning behavior, and then the configured action is executed. If it is configured to block, the data packet of the source IP will be discarded. If it is configured to audit only, the data packet will be released and the result will be logged.

[0065] The client agent regularly reports the monitored data (such as connection logs and port status) to the central management system through the https protocol.

[0066] After the management center receives the data reported by the client, it processes the data and generates an alarm log.

[0067] Embodiment 3: In an exemplary embodiment, a port scanning monitoring system based on a domestic server is also provided, including a management module, a data acquisition module and an analysis and control module.

[0068] Among them, the management module is deployed on the management side, and receives parameters and action configurations entered by the management personnel through the management interface or API interface. After the configuration is completed, the management module synchronizes the parameter information to the client through a network security protocol (such as HTTPS).

[0069] The management module is used to manage the configuration and execution action settings of the management terminal, receive data from the data acquisition module and analyze the control module, and generate alarm logs.

[0070] It is deployed on the client and is responsible for collecting network connection information and port status in real time. Specifically, it obtains inbound and outbound connection information (such as source IP, destination IP, port and protocol, etc.) through capture tools, and uses port monitoring technology to check the port status (open, closed, filtered).

[0071] The analysis and control module runs on the client side to analyze and process the collected data, compare the parameters configured on the management side with the collected real-time network connection information, trigger execution actions (such as no action, audit, blocking, etc.), and generate alarm logs.

[0072] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0073] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0074] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0075] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0076] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A port scanning monitoring method based on a domestic server, characterized in that: include: The management end configures parameters and executes actions; The client collects real-time network connection information and obtains port status; Compare parameter information and network connection information, trigger execution actions and generate alarm logs.

2. The port scanning monitoring method based on a domestic server as claimed in claim 1, characterized in that: After the management terminal configures parameters and executes actions, it also includes: The configured parameter information is synchronized with the client through the network security protocol. After the client receives the parameter information, it writes the information to the local file.

3. The port scanning monitoring method based on a domestic server as claimed in claim 2, characterized in that: The client collects real-time network connection information and obtains the port status, including that the client performs real-time data collection of network connection and port status through a capture tool and a port monitoring technology.

4. The port scanning monitoring method based on a domestic server as claimed in claim 3 is characterized in that: The comparing of parameter information and network connection information includes: the client generates a monitoring control table according to the received parameter information, compares the real-time network connection information with the monitoring control table, obtains a first result, and determines the triggering of the execution action according to the first result.

5. The port scanning monitoring method based on a domestic server as claimed in claim 4, characterized in that: The triggering of determining the execution action according to the first result includes comparing the first interval, the second interval and the third interval preset in the monitoring control table with the first result; The actions include no action, a first action, and a second action; The trigger includes: When the first result belongs to the first interval, no action is performed; When the first result belongs to the second interval, the first action is executed and the duration is recorded. When there is a source IP that triggers the first action for a long time, or the number of times the first action is triggered exceeds a preset threshold, the second action is executed; When the first result belongs to the third interval, a second action is performed.

6. The port scanning monitoring method based on a domestic server as claimed in claim 3 is characterized in that: The capture tools include but are not limited to network card driver hooks and network packet capture libraries; The port monitoring technology includes but is not limited to calling commands and APIs.

7. The port scanning monitoring method based on a domestic server as claimed in claim 6, characterized in that: The client performs real-time data collection of network connection and port status through capture tools and port monitoring technology, including that the client obtains network connection information in real time through the network card driver hook, and records all inbound and outbound connections and their status, including but not limited to source IP, target IP, port and protocol information; Use the internal command netstat-tuln to periodically check the open status of the port and record the open, closed, or filtered status.

8. A port scanning monitoring system based on a domestic server using any of the methods of claims 1 to 7, characterized in that: include, Management module, used for configuration and execution action setting of management terminal, receiving data from data acquisition module and analysis control module and generating alarm log; Data collection module, used to collect network connection information and port status in real time; The analysis and control module is used to analyze and process the collected data, compare the parameters configured by the management end with the collected real-time network connection information, and trigger the execution action.

9. A computer device comprising: Memory and processor; The memory stores a computer program, characterized in that: when the processor executes the computer program, the steps of the port scanning monitoring method based on a domestic server as described in any one of claims 1-7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the port scanning monitoring method based on the domestic server as described in any one of claims 1-7 are implemented.

Images