Active and passive combined cyberspace anti-mapping system

Abstract

The invention belongs to the technical field of computer network security, and particularly relates to an active and passive combined cyberspace anti-mapping system. The system comprises a network state sensing module, a detection flow identification module, an active surveying and mapping resisting strategy module and a passive surveying and mapping resisting strategy module. The network state sensing module collects network topology and key node information and provides data support for strategy formulation; the detection flow identification module identifies surveying and mapping attacks by capturing and analyzing network flow; the active surveying and mapping resisting strategy module dynamically selects and executes a strategy based on an identification result so as to actively defend surveying and mapping attacks; and the passive anti-mapping strategy module executes passive defense measures for the mapping flow which is mistakenly recognized as the normal flow. Through an active and passive combination mode, the network protection capability is effectively improved, and the surveying and mapping risk is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and in particular relates to a network space anti-mapping system. Background Art

[0002] Cyberspace mapping is one of the major threats in the field of network security. It uses various tools and techniques to detect and analyze the target network to obtain information such as the network's structure, services, equipment, and potential security vulnerabilities. These mapping behaviors seriously threaten the security and privacy protection of the network. Therefore, the development of cyberspace anti-mapping systems has become crucial. An effective anti-mapping system can significantly improve network protection capabilities, reduce potential network security risks, and ensure the security of critical information and infrastructure.

[0003] At present, most of the existing anti-mapping systems rely on active anti-mapping strategies. These systems usually include a detection traffic identification module, which identifies potential mapping attack traffic through real-time monitoring and analysis of network traffic. The core of this method lies in the accuracy of traffic identification, which requires the system to accurately analyze and identify mapping attack traffic, so as to take corresponding active defense measures. However, the accuracy of traffic identification is affected by many factors, such as the complexity of the network environment, the diversity and dynamics of traffic characteristics, etc., which may lead to inaccurate traffic identification and thus affect the effectiveness of active anti-mapping strategies. When traffic identification errors occur, the existing active anti-mapping system may not be able to effectively respond to mapping attacks, and may even introduce additional security risks due to misjudgment. Therefore, systems that rely solely on active anti-mapping strategies may appear to be powerless in complex and changing network environments. Summary of the invention

[0004] The present invention aims to provide an efficient and dynamic active and passive combined cyberspace anti-mapping system to effectively resist network mapping attacks and protect the security and privacy of cyberspace.

[0005] The cyberspace anti-mapping system proposed in the present invention adopts an anti-mapping strategy that combines active and passive methods. It not only performs active mapping traffic identification and defense through the detection traffic identification module, but also introduces a passive anti-mapping strategy module, which can maintain a certain anti-mapping capability for mapping traffic that is mistakenly identified as normal traffic. Through the combination of active and passive methods, it can effectively resist network mapping attacks and protect the security and privacy of cyberspace. Specifically, the cyberspace anti-mapping system proposed in the present invention includes a network status perception module, a detection traffic identification module, an active anti-mapping strategy module, and a passive anti-mapping strategy module; wherein:

[0006] The network status perception module is used to collect and analyze network status information in real time, including network topology changes, network key node analysis, etc., to provide a data basis for subsequent strategy formulation. Through in-depth analysis of network behavior, potential signs of mapping attacks can be identified;

[0007] The detection traffic identification module is responsible for monitoring and analyzing network traffic, and using traffic identification technology to identify mapping attack traffic in real time from massive network traffic;

[0008] The active anti-mapping strategy module dynamically selects and executes an active anti-mapping strategy for the identified mapping traffic based on the data of the network status perception module and the result of the detection traffic identification module;

[0009] The passive anti-mapping strategy module dynamically selects and executes a passive anti-mapping strategy for the mapping traffic that is mistakenly identified as normal traffic by the traffic identification module based on the data of the network status perception module.

[0010] Further:

[0011] The network status perception module includes a network topology monitoring submodule and a key node analysis submodule.

[0012] The network topology monitoring submodule is mainly responsible for collecting and analyzing the topology information in the network and the size and direction of the traffic between topologies in real time;

[0013] The key node analysis submodule further identifies and analyzes key nodes in the network based on network topology monitoring. Key nodes include nodes with high traffic, high importance or high risk characteristics, such as core routers, key servers, data center access points, etc. Through in-depth analysis of key nodes, more accurate target positioning is provided for subsequent anti-mapping strategies.

[0014] The detection flow identification module includes a flow capture submodule, a flow preprocessing submodule, a feature extraction submodule, a flow identification submodule, and an identification result analysis submodule; wherein:

[0015] The traffic capture submodule is responsible for capturing network data packets flowing through the network, which is achieved by setting up traffic collection facilities at the network interface, and ensuring that all or specified types of network traffic are captured through methods such as port mirroring and network splitters;

[0016] The traffic preprocessing submodule uses technologies such as protocol decoding, session reassembly, and IP fragment reassembly to perform preprocessing operations such as cleaning, deduplication, and decoding on the captured raw traffic data to facilitate subsequent analysis;

[0017] The feature extraction submodule extracts key features for identifying and mapping traffic from the preprocessed traffic data. Specifically, the model is trained using different features, and the feature with the highest recognition accuracy is selected as the key feature;

[0018] The traffic identification submodule is responsible for classifying and identifying traffic based on the extracted key features using machine learning, deep learning and other algorithms, and is responsible for classifying traffic into different categories such as normal traffic and potential mapping traffic, and further identifying specific mapping attack types;

[0019] The identification result analysis submodule outputs the traffic identification result to the system active anti-mapping strategy module. The traffic with the identification result of mapping attack is handled by the active anti-mapping strategy module, and the traffic with the identification result of normal is handled by the passive anti-mapping strategy module; at the same time, the classification result is fed back to the feature extraction submodule and the traffic identification submodule to further optimize the functions of both.

[0020] The active anti-mapping strategy module includes a strategy generation submodule, a strategy selection submodule, and a strategy execution submodule.

[0021] in:

[0022] The strategy generation submodule dynamically generates a targeted active anti-mapping strategy group according to the network status provided by the network status perception module and the result of the detection traffic identification module;

[0023] The strategy selection submodule selects the best active anti-mapping strategy from the active anti-mapping strategy group according to the current node status;

[0024] The strategy execution submodule is responsible for executing the active anti-mapping strategy selected by the strategy selection module, which usually includes configuring network equipment, adjusting network traffic, simulating false targets or disguising network responses, etc., to confuse or interfere with the detection activities of the surveying party.

[0025] The passive anti-mapping strategy module includes a node analysis submodule, a node configuration submodule, and a node management submodule.

[0026] in:

[0027] The node analysis submodule analyzes the applicable passive anti-mapping strategies according to the nature and function of the protected target, such as dynamic ports, dynamic IP, mimicry defense, etc.;

[0028] The node configuration submodule is responsible for configuring the node according to the passive anti-mapping strategy provided by the node analysis submodule;

[0029] The node management submodule is responsible for the management of the node adjustment process, such as the time interval of dynamic IP adjustment.

[0030] The network space anti-mapping system provided by the present invention has the following working process:

[0031] The network status perception module collects and analyzes network status information in real time; the detection traffic identification module monitors and analyzes network traffic, and identifies mapping attack traffic in real time; based on the data from the network status perception module and the results of the detection traffic identification module, the active anti-mapping strategy module dynamically selects and executes active anti-mapping strategies; based on the data from the network status perception module, the passive anti-mapping strategy module dynamically selects and executes passive anti-mapping strategies for mapping traffic that is mistakenly identified as normal traffic.

[0032] The technical features and advantages of the present invention mainly lie in:

[0033] It innovatively combines active and passive anti-mapping strategies to form a more comprehensive and efficient cyberspace anti-mapping system. The active anti-mapping strategy quickly identifies and defends against potential mapping attacks by real-time monitoring and analysis of network traffic, while the passive anti-mapping strategy plays a role when errors occur in active identification, and increases the difficulty of mapping attacks by attackers by dynamically configuring network nodes, such as changing ports, IP addresses, or using mimicry defense technology. This combination of active and passive strategies not only improves the system's anti-mapping capabilities, but also greatly enhances the security of the network. It can maintain a high defense effect and stability even in the face of complex and changing network environments and when the active anti-mapping strategy fails. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a diagram of the overall structural framework of the cyberspace anti-mapping system of the present invention.

[0035] Figure 2 It is a diagram showing the composition of the network status perception module of the present invention.

[0036] Figure 3 It is a diagram showing the structure of the detection flow identification module of the present invention.

[0037] Figure 4 It is a diagram showing the composition of the active anti-mapping strategy module of the present invention.

[0038] Figure 5 It is a diagram showing the structure of the passive anti-mapping strategy module of the present invention. DETAILED DESCRIPTION

[0039] The present invention is further described below by way of embodiments in conjunction with the accompanying drawings.

[0040] The active and passive combined network space anti-mapping system provided by the present invention has a structure as shown in Figure 1, including network status perception module, detection traffic identification module, active anti-mapping strategy module, and passive anti-mapping strategy module.

[0041] The network status perception module is the basis of the system. It collects and analyzes network status information in real time, providing data support for the subsequent anti-mapping strategy formulation; the detection traffic identification module is responsible for monitoring and analyzing network traffic, and identifying mapping attack traffic in real time; the active anti-mapping strategy module dynamically selects and executes active anti-mapping strategies based on the results of the network status perception module and the detection traffic identification module; the passive anti-mapping strategy is dynamically selected and executed based on the network status perception module and node information.

[0042] The network status perception module, its structure is as follows Figure 2 As shown, it includes a network topology monitoring submodule and a key node analysis submodule.

[0043] The network topology monitoring submodule collects the topology information in the network in real time through sensors or probes deployed in the network, including the connection relationship between nodes, link status, etc. Then, the collected topology data is processed using graph theory and network analysis algorithms to analyze the changing trend of the topology structure and identify possible abnormal behaviors or potential signs of mapping attacks.

[0044] Based on network topology monitoring, the key node analysis submodule identifies key nodes in the network, such as core routers, key servers, etc., through traffic analysis, importance assessment and other methods, and continuously monitors key nodes, analyzes the traffic characteristics and response time of the nodes, and further evaluates the security and potential risks of the nodes.

[0045] The structure of the detection flow identification module is shown in Figure 3 As shown, it includes a traffic capture submodule, a traffic preprocessing submodule, a feature extraction submodule, a traffic identification submodule and an identification result analysis submodule.

[0046] The traffic capture submodule is responsible for deploying traffic capture devices at key nodes of the network (such as border routers, firewalls, etc.) or at any designated location to capture the network data packets passing through. In this process, it is necessary to ensure that the captured data packets are complete and correct, without missing any important traffic information;

[0047] The traffic preprocessing submodule performs preliminary processing on the traffic to facilitate subsequent analysis and processing operations. This module performs protocol decoding on the captured original data packets to restore the data content of the application layer; regroups the data packets belonging to the same session for subsequent analysis; removes duplicate data packets and irrelevant information, and cleans the data to improve analysis efficiency;

[0048] The feature extraction submodule extracts features that can characterize the mapping attack from the preprocessed traffic data, such as specific protocol types, port numbers, traffic patterns, or deep features automatically extracted through deep learning and other methods. At the same time, the module will also continuously optimize the feature selection process based on the feedback from the recognition result analysis submodule to improve the effectiveness and discrimination of the features;

[0049] The traffic identification submodule uses machine learning, deep learning and other algorithms to classify and identify traffic. This module uses known normal traffic and mapping attack traffic data to train the identification model, and then inputs the real-time captured traffic data into the trained model for real-time identification and classification; assuming that there is currently a normal vector norm and a mapping vector map.

[0050] The identification result analysis submodule performs statistical analysis on the results of traffic identification. This module can obtain a mapping description vector α=[a1,a2,a3, … ,a n ] and the mapping change vector β = [b1, b2, b3, … ,b n ]. On the one hand, the recognition result analysis submodule feeds back the mapping description vector and mapping change vector to the feature extraction submodule and the traffic recognition submodule to further optimize the performance of the feature extraction and recognition algorithms. On the other hand, the submodule sends the mapping description vector and mapping change vector to the active anti-mapping strategy module;

[0051] The structure of the active anti-mapping strategy module is shown in Figure 4 As shown, it includes a strategy generation submodule, a strategy selection submodule and a strategy execution submodule.

[0052] The strategy generation submodule is responsible for building the active anti-mapping strategy matrix. The active anti-mapping strategy matrix is ​​a strategy library that contains a variety of active anti-mapping strategies, such as configuring network devices, adjusting network traffic, simulating false targets or disguising network responses, etc. Assuming that the active anti-mapping strategy matrix includes d strategies, for each strategy, its performance in preventing different mapping attacks is evaluated, and the adaptability vector of strategy i against different mapping attacks can be obtained:

[0053]

[0054] And the cost description vector:

[0055]

[0056] The adaptability matrix of the entire active anti-mapping strategy matrix can be obtained:

[0057] R=[γ1,γ2,γ3, … ,γ d ],

[0058] And the cost description matrix:

[0059] C=[cost1,cost2,cost3,…,cost d ];

[0060] The strategy selection module is based on the adaptability vector γ i , cost description vector cost i And the currently identified survey traffic map, select the most suitable strategy. The strategy selection logic formula is as follows:

[0061]

[0062] Among them, i * represents the final active anti-mapping strategy selected; ∈ represents the adaptability weight factor, which is used to adjust the importance of adaptability in strategy selection; γ i [map] represents the adaptability of strategy i to the mapping traffic map; ε represents a small positive number used to avoid division by zero; λ represents the cost weight factor used to adjust the importance of cost in strategy selection; represents the total cost of strategy i;

[0063] The passive anti-mapping strategy module, see Figure 5 As shown, it includes node analysis submodule, node configuration submodule and node management submodule. The main function of this module is to reduce the probability of successful node mapping through passive anti-mapping strategy when traffic identification fails.

[0064] The node analysis submodule is responsible for analyzing each node in the protected network and building a suitable passive anti-mapping matrix according to its properties and functions. Common passive anti-mapping strategies include dynamic port configuration, dynamic IP configuration, mimicry defense, etc. Similarly, it can be assumed that the passive anti-mapping strategy matrix includes d strategies. For each strategy, its performance in preventing different mapping attacks is evaluated, and the adaptability vector of strategy i against different mapping attacks can be obtained:

[0065]

[0066] And the cost description vector:

[0067]

[0068] The adaptability matrix of the entire active anti-mapping strategy matrix can be obtained:

[0069] R=[γ1,γ2,γ3,…,γ a ],

[0070] And the cost description matrix:

[0071] C=[cost1,cost2,cost3,…,cost a ];

[0072] The node configuration submodule configures the corresponding nodes according to the strategy provided by the node analysis submodule to achieve the passive anti-mapping effect. Unlike the active anti-mapping strategy, the passive anti-mapping strategy does not know the specific mapping traffic type, so it needs to be based on the mapping description vector α=[a1,a2,a3,…,a n ], surveying change vector β = [b1, b2, b3, ..., b n ] and the adaptability vector R and the cost description matrix C to obtain the final selected strategy. The strategy selection steps are as follows:

[0073] (1) For each strategy i, calculate its comprehensive adaptability score to the current mapping attack environment. The formula is as follows:

[0074]

[0075] Among them, w j is the element b in the mapping change vector j The weight of is used to adjust the contribution of attack increase or decrease to the fitness score.

[0076] (2) For each strategy i, calculate its comprehensive cost. The comprehensive cost is calculated by summing the elements of the cost description vector:

[0077]

[0078] (3) In order to balance adaptability and cost, a utility function U is defined, which comprehensively considers adaptability and cost;

[0079]

[0080] where ∈ is a small positive number that prevents the denominator from being zero. Then, we choose U i The biggest strategy * As the optimal strategy:

[0081] i * = arg max i U i , (5).

[0082] The node management submodule is responsible for managing and maintaining the passive anti-mapping configuration of the node to ensure the effectiveness and sustainability of the strategy. A regular detection mechanism is set up to check the protection effect of the current strategy and adjust the strategy configuration as needed; a fault alarm mechanism is set up to automatically notify the administrator when a configuration anomaly is detected, and provide a recovery guide or automatic repair function.

Claims

1. An active and passive combined cyberspace anti-mapping system, characterized in that: The anti-mapping strategy combining active and passive is adopted. The detection traffic identification module is used to actively identify and defend the mapping traffic. A passive anti-mapping strategy module is introduced to maintain a certain anti-mapping capability for the mapping traffic that is mistakenly identified as normal traffic. The two are combined to effectively resist network mapping attacks and protect the security and privacy of cyberspace. Specifically, the cyberspace anti-mapping system includes a network status perception module, a detection traffic identification module, an active anti-mapping strategy module, and a passive anti-mapping strategy module. Among them: The network status perception module is used to collect and analyze network status information in real time, including network topology changes and network key node analysis, to provide a data basis for subsequent strategy formulation; and to identify potential signs of mapping attacks through in-depth analysis of network behavior; The detection traffic identification module is responsible for monitoring and analyzing network traffic, and using traffic identification technology to identify mapping attack traffic in real time from massive network traffic; The active anti-mapping strategy module dynamically selects and executes an active anti-mapping strategy for the identified mapping traffic based on the data of the network status perception module and the result of the detection traffic identification module; The passive anti-mapping strategy module dynamically selects and executes a passive anti-mapping strategy for the mapping traffic that is mistakenly identified as normal traffic by the traffic identification module based on the data of the network status perception module.

2. The cyberspace anti-mapping system according to claim 1, characterized in that: The network status perception module includes a network topology monitoring submodule and a key node analysis submodule; wherein: The network topology monitoring submodule is responsible for collecting and analyzing the topology information in the network and the size and direction of the traffic between topologies in real time; The key node analysis submodule further identifies and analyzes key nodes in the network based on network topology monitoring; key nodes include nodes with high traffic, high importance or high risk characteristics; through in-depth analysis of key nodes, more accurate target positioning is provided for subsequent anti-mapping strategies.

3. The cyberspace anti-mapping system according to claim 2, characterized in that: The detection flow identification module includes a flow capture submodule, a flow preprocessing submodule, a feature extraction submodule, a flow identification submodule, and an identification result analysis submodule; wherein: The traffic capture submodule is responsible for capturing network data packets flowing through the network, which is achieved by setting up traffic collection facilities at the network interface to ensure that all or specified types of network traffic are captured; The traffic preprocessing submodule uses protocol decoding, session reassembly, and IP fragment reassembly technology to clean, de-duplicate, and decode the captured raw traffic data for subsequent analysis; The feature extraction submodule extracts key features for identifying and mapping traffic from the preprocessed traffic data; specifically, the model is trained using different features, and the feature with the highest recognition accuracy is selected as the key feature; The traffic identification submodule is responsible for classifying and identifying traffic based on the extracted key features using machine learning and deep learning algorithms, and is responsible for classifying traffic into different categories such as normal traffic and potential mapping traffic, and further identifying specific mapping attack types; The identification result analysis submodule outputs the traffic identification result to the system active anti-mapping strategy module; the traffic whose identification result is a mapping attack is handled by the active anti-mapping strategy module, and the traffic whose identification result is normal is handled by the passive anti-mapping strategy module; at the same time, the classification result is fed back to the feature extraction submodule and the traffic identification submodule to further optimize the functions of the two.

4. The cyberspace anti-mapping system according to claim 3, characterized in that: The active anti-mapping strategy module includes a strategy generation submodule, a strategy selection submodule, and a strategy execution submodule; wherein: The strategy generation submodule dynamically generates a targeted active anti-mapping strategy group according to the network status provided by the network status perception module and the result of the detection traffic identification module; The strategy selection submodule selects the best active anti-mapping strategy from the active anti-mapping strategy group according to the current node status; The strategy execution submodule is responsible for executing the active anti-mapping strategy selected by the strategy selection module, including configuring network equipment, adjusting network traffic, simulating false targets or disguising network response operations to confuse or interfere with the detection activities of the mapping party.

5. The cyberspace anti-mapping system according to claim 4, characterized in that: The passive anti-mapping strategy module includes a node analysis submodule, a node configuration submodule, and a node management submodule; wherein: The node analysis submodule analyzes the applicable passive anti-mapping strategies according to the properties and functions of the protected target, including dynamic ports, dynamic IP, and mimicry defense; The node configuration submodule is responsible for configuring the node according to the passive anti-mapping strategy provided by the node analysis submodule; The node management submodule is responsible for the management of the node adjustment process, including the time interval of dynamic IP adjustment.

6. The cyberspace anti-mapping system according to claim 5, characterized in that: In the active anti-mapping strategy module, the strategy generation submodule is responsible for building an active anti-mapping strategy matrix; the active anti-mapping strategy matrix is ​​a strategy library containing a variety of active anti-mapping strategies, including configuring network devices, adjusting network traffic, simulating false targets or disguising network responses; Assuming that the active anti-mapping strategy matrix includes d strategies, for each strategy, its performance in preventing different mapping attacks is evaluated, and the adaptability vector of strategy i against different mapping attacks is obtained: And the cost description vector: Get the adaptability matrix of the entire active anti-mapping strategy matrix: R=[γ1,γ2,γ3, … ,c d ], And the cost description matrix: C=[cost1,cost2,cost3,…,cost d ]; The strategy selection module is based on the adaptability vector γ i , cost description vector cost i And the currently identified surveying and mapping traffic map, select the most suitable strategy; the strategy selection logic formula is as follows: Among them, i * represents the final active anti-mapping strategy selected; ω represents the adaptability weight factor, which is used to adjust the importance of adaptability in strategy selection; γ i [map] indicates the adaptability of strategy i to the mapping traffic map; ε represents a small positive number, which is used to avoid division by zero; λ represents the cost weight factor, which is used to adjust the importance of cost in strategy selection; represents the total cost of strategy i.

7. The cyberspace anti-mapping system according to claim 6, characterized in that: In the passive anti-mapping strategy module, the node analysis submodule is responsible for analyzing each node in the protected network and building a suitable passive anti-mapping matrix according to its properties and functions; assuming that the passive anti-mapping strategy matrix includes d strategies, for each strategy, its performance in preventing different mapping attacks is evaluated to obtain the adaptability vector of strategy i for different mapping attacks: And the cost description vector: Get the adaptability matrix of the entire active anti-mapping strategy matrix: R=[γ1,γ2,γ3, … ,c d ], And the cost description matrix: C=[cost1,cost2,cost3,…,cost d ]; The node configuration submodule configures the corresponding nodes according to the strategy provided by the node analysis submodule to achieve passive anti-mapping. Specifically, for the mapping description vector α=[a1,a2,a3, … ,a n ], mapping change vector β = [b1, b2, b3, … ,b n ] and the adaptability vector R and the cost description matrix C to obtain the final selected strategy. The strategy selection steps are as follows: (1) For each strategy i, calculate its comprehensive adaptability score to the current mapping attack environment. The formula is as follows: Among them, w j is the element b in the mapping change vector j The weight of is used to adjust the contribution of attack increase or decrease to the fitness score; (2) For each strategy i, calculate its comprehensive cost. The comprehensive cost is calculated by summing the elements of the cost description vector: (3) In order to balance adaptability and cost, a utility function U is defined, which takes adaptability and cost into consideration; Among them, ∈ is a small positive number used to prevent the denominator from being zero; then, choose U i The biggest strategy * As the optimal strategy: i * =arg max i U i , (5)。

Images