Bypass mirror image-based active defense method and device for security of Internet of Things, and medium

Abstract

The embodiment of the invention discloses an Internet of Things security active defense method and device based on a bypass mirror image and a medium, and relates to the technical field of network security. The method comprises the following steps: acquiring network traffic between external equipment and Internet of Things equipment through a bypass monitoring mode; and under the condition that an attack behavior is detected in the network flow, constructing a blocking data packet according to the characteristics of the Internet of Things equipment, and transmitting the blocking data packet to interrupt a subsequent session. According to the embodiment, the dangerous situation is actively blocked by detecting the flow of the Internet of Things.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to an active security defense method, device and medium for the Internet of Things based on bypass mirroring. Background Art

[0002] With the development of network technology, Internet of Things technology has been widely used in the fields of enterprise production, urban operations, personal privacy, etc., bringing conveniences such as full interconnection, full-domain perception, and remote control, but also bringing new network security risks.

[0003] If the security risks of IoT are not handled properly or timely in industrial production, it may cause serious impacts such as data leakage, system paralysis, and production stagnation. How to detect and block IoT security risks in a timely manner without affecting industrial production is an urgent problem to be solved.

[0004] In view of this, the present invention is proposed. In the prior art, patent CN111478888A discloses a bypass blocking method, device and storage medium, and CN117914605A provides a micro-segment protection method and related products for industrial Internet of Things, which are different from the present invention. Summary of the invention

[0005] The embodiment of the present invention provides an active security defense method, device and medium for the Internet of Things based on bypass mirroring, which actively blocks dangerous situations by detecting the traffic of the Internet of Things.

[0006] In a first aspect, an embodiment of the present invention provides an IoT security active defense method based on bypass mirroring, comprising: Obtain network traffic between external devices and IoT devices through bypass monitoring; When an attack behavior is detected in the network traffic, a blocking data packet is constructed and sent out according to the characteristics of the IoT device to interrupt subsequent sessions; Specifically, when the intranet includes a fixed-length subnet, the distribution pattern of the attack behavior in the network traffic in the intranet segment is detected; if the attack behavior shows the characteristics of segmented repetition in the intranet segment, a blocking data packet is constructed and sent out according to the number of IP addresses in each segment and the number of IP addresses in each fixed-length subnet to interrupt subsequent sessions and destroy the segmented repetition characteristics or disrupt the IP address allocation pattern of the Internet of Things devices in each segment.

[0007] In a second aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the bypass mirror-based active Internet of Things security defense method described in any embodiment.

[0008] In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the bypass mirror-based active Internet of Things security defense method described in any embodiment is implemented.

[0009] The embodiment of the present invention provides an active defense method for IoT security based on bypass mirroring. In the mode of bypass deployment monitoring, active defense is performed on the discovered attack behavior; when the attack behavior is detected, the communication details of both parties of the traffic are simulated, and a blocking data packet is actively constructed for outbound transmission, interrupting subsequent sessions, thereby achieving the purpose of blocking. Among them, the blocking data packet is constructed according to the communication protocol of the IoT device, and IoT devices with different protocols will correspond to different blocking data packets.

[0010] In particular, this embodiment provides a method for detecting distributed attack behaviors in response to the weaknesses of similar network structures and IP planning of various business units in some production and operation systems, which can promptly discover distributed attack behaviors that use the same attack strategies against various business units; and combined with subnet division, it analyzes the degree of danger in various situations, clarifies the high-risk IP addresses and specific protection measures that need to be protected in various situations, and improves the network security of the production and operation system of multiple business units. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0012] Figure 1 This is a functional structure diagram of an IoT security active defense device provided by an embodiment of the present invention; Figure 2 This is a schematic diagram of a deployment method of an IoT security active defense device provided by an embodiment of the present invention; Figure 3 It is a flow chart of an IoT security active defense method based on bypass mirroring provided by an embodiment of the present invention; Figure 4 It is a schematic diagram of another deployment method of an IoT security active defense device provided by an embodiment of the present invention; Figure 5This is a schematic diagram of IP address distribution of a first subnet and a second subnet provided by an embodiment of the present invention; Figure 6 This is another schematic diagram of IP address distribution of a first subnet and a second subnet provided by an embodiment of the present invention; Figure 7 This is another schematic diagram of IP address distribution of a first subnet and a second subnet provided by an embodiment of the present invention; Figure 8 This is another schematic diagram of IP address distribution of a first subnet and a second subnet provided by an embodiment of the present invention; Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0014] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0015] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0016] The embodiment of the present invention provides an IoT security active defense method based on bypass mirroring. In order to illustrate the method, an IoT security active defense device supporting the method and its deployment method are first introduced. Figure 1 is a functional structure diagram of an IoT security active defense device provided by an embodiment of the present invention, such as Figure 1 As shown in the figure, the device includes terminal acquisition module, terminal management module, security detection module and traffic tracing module, etc., which can perform asset identification, risk monitoring and traffic tracing for IoT terminals. Specifically, the device can access traffic through various methods such as traffic access and offline import, and combine with passive asset learning mechanism to perform data preprocessing, protocol analysis and fingerprint matching on the traffic to accurately identify IoT terminals; it can combine intrusion detection, virus detection and other technologies to accurately analyze and judge deep attack behaviors in the network, and actively and effectively protect the security of IoT terminals by combining professional processing opinions; at the same time, it can further analyze risk behaviors by retaining original traffic data and restoring and extracting suspected malicious samples.

[0017] In terms of intrusion detection, the device is based on comprehensive and in-depth protocol analysis, integrating comprehensive technical means such as packet decoding and feature rule matching, deeply analyzing L2~L7 layer networks to determine intrusion behaviors, accurately discovering more than 15,000 network attack behaviors including phishing attacks, malicious SSL certificates, redirection attacks, obtaining permissions, denial of service, vulnerability exploits, etc., fully ensuring the security of the Internet of Things. It should be noted that Figure 1 Only one type of IoT security active defense device is shown. New devices obtained by adding, reducing or replacing individual modules or functions on the basis of this device all fall within the protection scope of this embodiment.

[0018] Combination Figure 2 In actual applications, the device can be connected to the core of the intranet or one side of the access switch in a bypass deployment mode, monitor the network without affecting the performance of the business network, learn the assets of the IoT terminals, and provide real-time detection of internal and external attacks to improve the security of the network. The external network in the figure can be the Internet or a wide area network outside the intranet; the firewall can also be replaced by other security devices or omitted, and this embodiment does not make specific restrictions.

[0019] Based on the above equipment and deployment methods, Figure 3 : is a flow chart of an IoT security active defense method based on bypass mirroring provided by an embodiment of the present invention. The method is executed by the IoT security active defense device or other electronic devices, such as Figure 3 As shown, the method specifically includes: S110. Obtain network traffic between the external device and the IoT device through bypass monitoring.

[0020] The IoT device in this embodiment is a broad concept, including IoT terminals (such as gas pumps, sensors, inspection meters, etc.), and other devices that connect IoT terminals to the network and work with them (such as network communication equipment, industrial computers, office computers, etc.). External devices refer to devices from the external network. Figure 2 , external devices can access the IoT devices in the intranet through the firewall and the switch. This embodiment detects the network traffic between the external device and the IoT device so as to detect the attack behavior in time and take active defense.

[0021] S120: When an attack behavior is detected in the network traffic, a blocking data packet is constructed and sent out according to the characteristics of the IoT device to interrupt subsequent sessions.

[0022] In the bypass monitoring mode, when an attack is detected, this embodiment simulates the communication details of both parties of the traffic, actively constructs a blocking data packet for outbound transmission, and interrupts subsequent sessions, thereby achieving the purpose of blocking. Optionally, the detection of attack behavior can be achieved through the above-mentioned intrusion detection function. The characteristics of the logistics networking equipment can include the communication protocol, interface characteristics, and device vulnerability library of the Internet of Things equipment.

[0023] In a specific implementation, if an IP address in a blacklist of an IoT device is detected in the network traffic and is requesting access to the IoT device, it can be considered that an attack has been detected, and a session termination data packet can be constructed and sent out according to the communication protocol of the IoT device. For example, if the IoT device follows the TCP / IP protocol, an error confirmation message can be returned in the third handshake message, thereby blocking the communication connection.

[0024] In addition, there is such a situation in the existing IoT network: if a certain production and operation system includes multiple business units, and the IoT devices and networking requirements of each business unit are basically the same, then in the network planning, part of the intranet segment is usually divided into multiple fixed-length subnets, and each fixed-length subnet is allocated to each business unit; at the same time, since the types of IoT devices and data transmission requirements of each business unit are basically the same, the same network structure and IP address allocation scheme are usually used in each fixed-length subnet, which is convenient for unified network management and operation and maintenance. For example, in a gas station system in a region, each gas station can be used as a business unit, and the types of IoT devices in each business unit are basically the same, including office computers, industrial computers, network communication equipment (switches, routers), gas pumps, liquid level meters, POS machines and other sensors, etc. The business data that each IoT device needs to collect and transmit is also basically the same, such as oil payment data, safety inspection data, etc. Assuming that the continuous network segment of the regional intranet is 10.192.xx, a part of the continuous network segment is usually used for business units, and the network segment is divided into multiple fixed-length subnets, each of which is assigned to a business unit. The number of IP addresses of each subnet is the same, and it can accommodate the number of IoT devices of each business unit. Assuming that the number of IP addresses of each subnet is 32, each IP address includes a 27-bit network number and a 5-bit host number, a total of 32 binary numbers, the first IP address in the subnet segment is the network number, and the last IP address is the broadcast address. These two addresses cannot be used, and the remaining IP addresses can be assigned to IoT devices. At the same time, the IP address planning scheme in each subnet is usually consistent. The corresponding IP address segments are planned in sequence according to different device types, and the same type of IoT devices are assigned continuous IP addresses. For example, the second and third IP addresses in the subnet are assigned to office computers, the next four IP addresses are assigned to network communication equipment, the next seven IP addresses are assigned to gas pumps, and the next three IP addresses are assigned to liquid level meters, etc.; IP addresses are assigned in each business unit according to this planning scheme.

[0025] When an attacker encounters the above-mentioned business unit system, he may assume that each business unit uses the same fixed-length subnet and the IP address allocation scheme within the subnet is the same. After he has learned the business unit network segment of the entire area, he can divide it into multiple fixed-length subnets and use the same and similar attack strategies for each fixed-length subnet to detect the actual fixed-length subnet structure and increase the probability of successful attacks on the same type of devices. This embodiment refers to this attack strategy as distributed attack behavior. However, since the attacker may not accurately know the subnet length and the IP address allocation scheme within the subnet, the fixed-length subnet divided by the attacker may not match the actual fixed-length subnet. For the convenience of distinction and description, this embodiment refers to the fixed-length subnet actually used in the business unit as the first subnet, and the fixed-length subnet divided by the attacker as the second subnet. The attacker expects the second subnet to be as close to the first subnet as possible (including the subnet capacity and the IP address allocation scheme of various types of devices in the subnet) to facilitate accurate attacks on devices in the business unit. The so-called accurate attack means launching the same attack on IP addresses of the same device type, and / or launching attacks on the weaknesses of the device type connected to the IP address. For example, when the attacker believes that the second and third IP addresses in each second subnet correspond to the same type of device, the same attack behavior can be launched against the two IP addresses. Then, the probability of the attack behavior hitting any one of the two devices is greater than the probability of hitting a specific one of them; and / or when the attacker believes that the fourth to sixth IP addresses in each second subnet are connected to a gas station, the same attack behavior can be launched against these three IP addresses to target the gas station's vulnerability, further increasing the probability of successful attacks on the same type of device. At the same time, the first example of the above-mentioned accurate attack is also the reason why the same attack strategy can be used on multiple second subnets to increase the success rate of the attack. For example, there is no vulnerability in the gas station in the first second subnet, but there may be vulnerabilities in the gas stations in other second subnets. Therefore, launching attacks on gas stations in multiple subnets at the same time makes it easier to succeed.

[0026] In order to deal with this distributed attack behavior, this embodiment deploys the above-mentioned IoT security active defense device or other electronic equipment in bypass mode on one side of the upper gateway (such as a switch) of all business units, monitors the network traffic of all business units, detects this distributed attack behavior and blocks it in time. The deployment method is as follows: Figure 4 As shown, three business units are shown in the figure.

[0027] In a specific implementation, based on the above deployment method, the IoT security active defense device can be used to detect the distribution pattern of attack behaviors in network traffic in the intranet segment, and check whether the attack behaviors show the characteristics of segmented repetition in the intranet segment. Optionally, the intranet segment can be divided into fixed-length subnet segments (i.e. Figure 4The IP addresses in the business unit network segment in the network are arranged in order of size; then the attack behaviors with each IP address as the target address are arranged in order of the IP address to obtain an attack behavior sequence. Specifically, the attack behaviors with each IP address as the target address can be detected from the network traffic for a period of time; then the detected attack behaviors are represented as type variables, each attack behavior is represented by a value, and the value of each type variable is weighted averaged according to the number of occurrences to obtain the attack behavior value corresponding to each IP address, and these values ​​are arranged in the order of the IP address to obtain an attack behavior sequence.

[0028] Then, the attack behavior sequence is subjected to Fourier transform to check whether the sequence spectrum is concentrated near a certain frequency, for example, whether 80% of the energy in the sequence spectrum is concentrated in a set interval centered on a certain frequency. If so, it indicates that the attack behavior sequence shows the characteristics of periodic repetition in the sequence with the IP address as the independent variable. Corresponding to the IP network segment, the attack behavior shows the characteristics of segmented repetition in the IP network segment, that is, there is a set of attack behaviors in one segment of IP addresses, and the same set of attack behaviors appears in the next segment of IP addresses. At this time, it can be considered that the above-mentioned distributed attack behavior based on the second subnet has occurred, or there is a trend of such distributed attack behavior, and the repetition period or frequency of the attack behavior corresponds to the capacity of the second subnet. Of course, the above-mentioned periodic or segmented repetition characteristics can also be manually determined by network security personnel, and this embodiment does not make specific restrictions.

[0029] Furthermore, since the fixed-length subnet division is achieved by using the host bit (the number of bits in the host number) in the IP address as the network bit (the number of bits in the network number), for every increase in the network bit, the host bit will be reduced by one, and the corresponding subnet network address will be halved. Therefore, the frequency at which the energy is concentrated in the above spectrum has a power-of-2 relationship with the periodic repetition frequency of the fixed-length subnet in the business unit network segment, and the length of the second subnet can be converted through this relationship. Since the attacker does not accurately know the true length of the first subnet, the length of the second subnet divided by the attacker may be 2 to the nth power times the length of the first subnet, or one-tenth of 2 to the nth power, or they may be equal, where n is a natural number. At this time, according to the length relationship between the second subnet and the first subnet, a blocking data packet can be constructed and sent out to interrupt subsequent sessions, and destroy the segmented repetitive characteristics of the network structure that the attacker may know, or disrupt the IP address allocation rules of the Internet of Things devices in each IP subnet that the attacker may know. Specifically, this embodiment provides the following three optional implementation methods: The first optional implementation is applicable to the case where the length of the second subnet is greater than the length of the first subnet, that is, the length of the second subnet is 2 to the power of n times the length of the first subnet, such as 2 times, 4 times, 8 times... Figure 5Taking 2 times as an example, the IP address distribution of two subnets is shown. Figure 5 As shown, the horizontal axis represents the IP addresses arranged in order of size within the business unit network segment. Assuming there are 128 consecutive IP addresses, they are arranged in order from small to large according to the host number as IP0, IP1, IP2, IP3, ... IP127. Each first subnet in the business unit covers 32 IP addresses, and the entire network segment includes 4 first subnets. In the detected attack traffic, each second subnet covers 64 IP addresses, and the entire network segment includes 2 second subnets. The attacker will launch the same or similar attack behavior against the IP addresses in the same position in the second subnet, such as launching the same or similar attack behavior against the first IP in each second subnet. Figure 5 As shown, since the attack strategy will not be repeated in the first and second halves of the second subnet (if it occurs, the frequency of segment repetition will double, and the second subnet will not be the current length), when the same attack strategy is used for each second subnet, even if there is an extreme situation where the attack behavior on each IP address in the first half of the second subnet is consistent with the device vulnerability library of each IP address in the first subnet, it will only hit all the devices in the first half and will not hit all the devices in the second half. Therefore, it will not cause paralysis of all first subnets. Moreover, under normal circumstances, all the devices in the first half will not be hit, so the crisis level of this situation is relatively light.

[0030] However, if the attacker knows in advance the order in which IP addresses are allocated according to the type of IoT devices in the subnet, for example, if the attacker knows that IP addresses are allocated in the order of office computers, network communication equipment, gas pumps, liquid level meters, and POS machines in each subnet, then the attacker may also launch attacks on the IP addresses arranged in that order according to the vulnerabilities of office computers, network communication equipment, gas pumps, liquid level meters, and POS machines. This situation usually occurs when the attacker has already hit some devices in a business unit and obtained the IP allocation order of these device types, and then applied this allocation order to other business units. However, since the number of each type of device in each business unit is different, there is still a difference between the allocation order and the specific IP address allocation plan. Then, combined with Figure 5It can be seen that if the attacker has the correct allocation order, the device types that the attacker considers the start IP address and the end IP address of each second subnet are most likely to match the real device types in the first subnet, and the probability of being successfully attacked is the highest. For example, after the attacker knows that the IP addresses are allocated in the order of office computers, network communication equipment, gas pumps, liquid level meters, and POS machines in the subnet, he believes that the start IP address IP1 of the first second subnet is an office computer and the end IP address IP62 is a POS machine. The start IP address IP1 of the first first subnet is indeed an office computer, and the end IP address IP62 of the second first subnet is indeed a POS machine, which is exactly the same; and whether the device types that the attacker considers the other IP addresses in the second subnet except the start IP and the end IP are consistent with the real device types of these IP addresses in the first subnet depends on the specific number of devices in the business unit, and the probability of consistency cannot be accurately estimated. The risk of these IP addresses is smaller than the start IP address and the end IP address of the second subnet. Therefore, this embodiment uses the repeated IP addresses in the start and end IP addresses of each second subnet and the start and end IP addresses of each first subnet (in this optional implementation mode, actually the start and end IP addresses of each second subnet) as high-risk IP addresses.

[0031] When an attack behavior with the high-risk IP address as the target address is detected again in the future, the IoT security active defense device, on the one hand, constructs a blocking data packet that complies with the protocol used by the IoT device at the address and sends it to the IoT device to prevent the IoT device from continuing to interact with data; on the other hand, selects other devices with the lowest similarity to the IoT device at the high-risk IP address, and constructs a blocking data packet according to the communication protocol of the other devices and sends it out, so as to trick the attacker into changing the judgment of the device type of the IP address, making it mistakenly believe that the device type of the IP address is other devices, thereby affecting the IP address allocation order and subnet segment structure it has mastered. For IP addresses other than high-risk IP addresses, conventional blocking can be performed without simulating other IoT devices to deceive the attacker. Among them, the device similarity can be determined artificially, or it can be pre-calculated according to the device attributes and stored in the IoT security active defense device. The specific calculation method will be described in detail in the subsequent embodiments.

[0032] In addition to simulating high-risk IP addresses as other devices, the endpoint IP addresses between adjacent second subnets can also be used as interference IP addresses, and the interference IP addresses can be used to interfere with the attacker's setting of the length of the second subnet. Figure 5, IP63 and IP64 can be used as interference addresses, where IP63 is a broadcast address in the second first subnet, and IP64 is a network number in the third first subnet, which will not be assigned to a specific IoT device. Therefore, under normal circumstances, when the access traffic of these two IP addresses is received, the connection will fail. However, after using these addresses as interference IP addresses, when an attack behavior with the interference IP as the target address is detected again (this behavior may be a detection behavior, or it may be an attack behavior generated when the above periodicity is not strict), the interference IP address can be simulated as any IoT device, and a blocking data packet is constructed and sent out according to the communication protocol of the IoT device, gradually deceiving the attacker into mistakenly believing that the IP address is an available IP address, thereby increasing the length of the second subnet. The longer the length of the second subnet, the lower the risk, thereby reducing the harm caused by distributed attack behaviors to the entire network.

[0033] The second optional implementation is applicable to the case where the length of the second subnet is the same as the length of the first subnet, such as Figure 6 As shown. At this time, if the attacker further grasps the IP allocation order of the IoT devices in the subnet, and adopts corresponding attack behaviors for the vulnerabilities of various device types, the probability of hitting the device in each first subnet will be very high. Still taking the extreme case in the first optional implementation as an example, if the attack behaviors on each IP address of the second subnet are respectively consistent with the device vulnerability library of each IP address of the first subnet, all first subnets will be hit at the same time, so the crisis level of this situation is the highest among the three optional implementations. In view of this, in addition to treating the start and end IPs of each second subnet and the repeated IPs in the start and end IPs of each first subnet (in this embodiment, it is actually the start IP address and end IP address of each second subnet) as high-risk IPs, this embodiment also extracts several IPs from the inside of the first subnet and adds them to the high-risk IP list.

[0034] When attacks targeting high-risk IP addresses are detected again in the future, the IoT active security defense device, on the one hand, constructs a blocking data packet that complies with the protocol used by the IoT device at the address and sends it to the IoT device, thereby preventing the IoT device from continuing to interact with data. On the other hand, it selects other devices with the lowest similarity to the IoT device at the current high-risk IP address, constructs a blocking data packet based on the communication protocol of the other devices, and sends it out, in order to trick the attacker into changing its judgment of the device type at the IP address, causing it to mistakenly believe that the device type at the IP address is some other device, thereby affecting the IP address allocation order and subnet segment structure that it has mastered.

[0035] Similarly, in addition to simulating high-risk IP addresses as other devices, the endpoint IP addresses between adjacent second subnets can also be used as interference IP addresses, and the interference IP addresses can be used to interfere with the attacker's setting of the length of the second subnet. Figure 6 , IP31, IP32, IP95, and IP96 can be used as interference addresses. Since IP31 and IP95 are broadcast addresses in the first subnet, and IP32 and IP96 are network numbers in the first subnet, they will not be assigned to specific IoT devices. Therefore, under normal circumstances, when access traffic from these IP addresses is received, the connection will fail. However, after using these addresses as interference IP addresses, when an attack behavior with the interference IP as the target address is detected again, the interference IP address can be simulated as any IoT device, and a blocking data packet is constructed and sent out according to the communication protocol of the IoT device, gradually deceiving the attacker into mistakenly believing that the IP address is an available IP address, thereby increasing the length of the second subnet. The longer the length of the second subnet, the lower the risk, thereby reducing the harm caused by distributed attack behaviors to the entire network.

[0036] The third optional implementation is applicable to the case where the length of the second subnet is smaller than the length of the first subnet, that is, the length of the second subnet is one nth of 2 of the first subnet, such as 1 / 2, 1 / 4, 1 / 8... Figure 7 Taking 1 / 2 as an example, the IP address distribution of the two subnets is shown. Figure 7 As shown, although the attacker uses the same attack strategy for each second subnet, due to the different distribution of device types in the first half and the second half of the first subnet, the IoT devices with the same order of IP addresses in each second subnet are not necessarily exactly the same. The higher the similarity of the two devices, the greater the risk of the IP address. Exemplarily, an attack behavior against a certain IP address IP2 in the second subnet will simultaneously act on the IoT devices with IP address IP18 at the same position (same order) in two second subnets in the same first subnet. The higher the similarity of the IoT devices IP2 and IP18, the greater the probability that the same attack behavior hits any one of the two IoT devices, thereby increasing the network risk. Therefore, in addition to treating the repeated IPs in the start and end IPs of each second subnet and the start and end IPs of each first subnet (in this embodiment, actually the start IP address and the end IP address of each first subnet) as high-risk IPs, this embodiment also calculates the similarity of IoT devices corresponding to the IP addresses at the same position (or the same order) in each second subnet, and treats IP addresses with similarity higher than the set threshold as high-risk IP addresses.

[0037] Furthermore, the device similarity can be determined manually or calculated in the following way: First, the similarity of the two IoT devices in terms of known risks is determined based on the vulnerability library or baseline standard of the two IoT devices, which is called the known risk similarity. In this embodiment, the vulnerability library of each IoT device is obtained in advance. The more the number of identical vulnerabilities in the vulnerability library of the two IoT devices, the higher the similarity of the known risks of the two IoT devices; in addition, the known risk similarity can also be determined based on the security baseline of each IoT device. The more the number of identical requirements in the security baseline of the two IoT devices, the higher the similarity of the known risks of the two IoT devices. Optionally, the known risk similarity can be expressed as the proportion of the number of identical vulnerabilities in the combined set of vulnerability libraries of the two devices, or the proportion of the number of identical baseline requirements in the combined set of baseline requirements of the two devices.

[0038] At the same time, the potential risk similarity can also be determined based on the basic attributes of the two IoT devices, wherein the basic attributes include device purpose, device form, device installation location, etc. Specifically, the similarity of the basic attributes between each two IoT devices is different. For example, the device similarity between office computers and industrial computers is higher than the device similarity between office computers and gas dispensers. Different basic attributes of devices mean that the security standards and attack methods of the devices are also different. Therefore, the similarity of IoT devices in terms of unknown risks can be calculated based on the basic attributes of the devices, which is called potential risk similarity. These risks may not be identified in the existing vulnerability library, but they also need potential protection. Specifically, the potential risk similarity can be determined artificially based on the basic attributes of the device, or the basic attribute description of the device can be converted into an embedded vector and measured by vector similarity. After obtaining the known risk similarity and potential risk similarity, the two similarities are weighted and summed to determine the comprehensive similarity of the two IoT devices.

[0039] By adopting the above method, the similarity of IoT devices assigned to IP addresses at the same position in two second subnets can be obtained. If there are more than two second subnets, the similarity of IoT devices with IP addresses at the same position in each of the two second subnets can be calculated, and these similarities can be averaged as the device similarity corresponding to these IP addresses. Perform the above operation on the IP address at each position in each second subnet respectively, and the device similarity of the IP address at each position can be obtained; if the device similarity of a certain position is greater than the set threshold, the IP address at this position in each second subnet will be regarded as a high-risk IP address.

[0040] When attacks targeting high-risk IP addresses are detected again in the future, the IoT active security defense device, on the one hand, constructs a blocking data packet that complies with the protocol used by the IoT device at the address and sends it to the IoT device, thereby preventing the IoT device from continuing to interact with data. On the other hand, it selects other devices with the lowest similarity to the IoT device at the current high-risk IP address, constructs a blocking data packet based on the communication protocol of the other devices, and sends it out, in order to trick the attacker into changing its judgment of the device type of the IP, causing it to mistakenly believe that the device type under the IP is other devices, thereby affecting the IP address allocation order and subnet segment structure it has mastered.

[0041] In summary, the above three optional implementation methods are all applicable to the case where the attacker obtains the service unit network segment in advance. Figure 5 , Figure 6 , Figure 7 The endpoint IP addresses of the first subnet and the second subnet overlap. If the attacker does not know the business unit network segment in advance, it may conduct distributed attacks or detection behaviors on a wider IP range outside the business unit network segment. At this time, the IoT security active defense device can be deployed at the entrance of a wider IP range including the business unit network segment to monitor traffic. When a distributed attack occurs, the second subnet detected may be different from the first subnet as follows: Figure 8 The situation shown. At this time, no matter whether the length of the second subnet is greater than, less than or equal to the length of the first subnet, and no matter whether the attacker has mastered the order of IP address allocation of various types of devices in the subnet, all first subnets will not be accurately attacked at the same time. The attack effect depends more on the similarity of IoT devices with IP addresses at the same position in each second subnet. If the similarity of IoT devices with IP addresses at the same position is greater than the set threshold, all IP addresses corresponding to the similarity are treated as high-risk IP addresses, and the same operations as the above embodiment are performed.

[0042] Exemplary, combined Figure 8, assuming that IP8 and IP70 are the 5th IP addresses in the two second subnets respectively, the positions of the two IP addresses in the two second subnets are the same, and the similarity of the IoT devices actually assigned to the two IP addresses can be calculated. For example, if IP8 is assigned to a gas station and IP70 is assigned to a POS machine, the similarity between the gas station and the POS machine is calculated using the above method as the device similarity corresponding to the 5th IP address in the second subnet. If there are more than two second subnets, the similarity of the IoT devices of the 5th IP in each of the two second subnets is calculated respectively, and these similarities are averaged to obtain the device similarity corresponding to the 5th IP address in the second subnet. When the length of the second subnet is 64, a device similarity is calculated for each of the 64 IP positions in the second subnet in the same manner. If the device similarity at a certain IP position is greater than the set threshold, such as the similarity of the 5th IP address is greater than the set threshold, the 5th IP address in each second subnet is treated as a high-risk IP address, and the same operation as the above embodiment is performed.

[0043] In summary, this embodiment provides an IoT security active defense method based on bypass mirroring, which uses IoT security active defense equipment in a bypass deployment monitoring mode to actively defend against discovered attack behaviors. Specifically, when an attack behavior is detected, the communication details of both parties of the traffic are simulated, and a blocking data packet is actively constructed for outbound transmission to interrupt subsequent sessions, thereby achieving the purpose of blocking. Among them, the blocking data packet is constructed according to the communication protocol of the IoT device, and IoT devices with different protocols will correspond to different blocking data packets.

[0044] In particular, this embodiment provides a method for detecting distributed attack behaviors in response to the weaknesses of similar network structures and IP planning of various business units in some production and operation systems, which can promptly discover distributed attack behaviors that use the same attack strategies against various business units; and combined with subnet division, it analyzes the degree of danger in various situations, clarifies the high-risk IP addresses and specific protection measures that need to be protected in various situations, and improves the network security of the production and operation system of multiple business units.

[0045] It is understandable that the IoT security active defense devices in the above-mentioned embodiments and beneficial effects can be replaced by other electronic devices as long as the bypass deployment conditions are met.

[0046] Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Fig. 9 As shown, the device includes a processor 60, a memory 61, an input device 62 and an output device 63; the number of processors 60 in the device can be one or more. Fig. 9A processor 60 is taken as an example; the processor 60, the memory 61, the input device 62 and the output device 63 in the device can be connected by a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0047] The memory 61 is a computer-readable storage medium that can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the bypass mirror-based IoT security active defense method in the embodiment of the present invention. The processor 60 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 61, that is, realizing the above-mentioned bypass mirror-based IoT security active defense method.

[0048] The memory 61 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may further include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0049] The input device 62 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 63 may include a display device such as a display screen.

[0050] An embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the bypass mirror-based active Internet of Things security defense method of any embodiment is implemented.

[0051] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0052] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0053] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0054] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0055] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present invention.

Claims

1. An active security defense method for the Internet of Things based on bypass mirroring, characterized in that: include: Obtain network traffic between external devices and IoT devices through bypass monitoring; When an attack behavior is detected in the network traffic, a blocking data packet is constructed and sent out according to the characteristics of the IoT device to interrupt subsequent sessions; Specifically, when the intranet includes a fixed-length subnet, the distribution pattern of the attack behavior in the network traffic in the intranet segment is detected; if the attack behavior shows the characteristics of segmented repetition in the intranet segment, a blocking data packet is constructed and sent out according to the number of IP addresses in each segment and the number of IP addresses in each fixed-length subnet to interrupt subsequent sessions and destroy the segmented repetition characteristics or disrupt the IP address allocation pattern of the Internet of Things devices in each segment.

2. The method according to claim 1, characterized in that The detecting of the distribution pattern of the attack behavior in the network traffic in the intranet segment includes: Arrange the IP addresses in the network segments divided into fixed-length subnets in the intranet in order; Arrange the attack behaviors with each IP address as the target address in the order of the IP addresses to obtain the attack behavior sequence; Performing Fourier transformation on the attack behavior sequence to check whether the sequence spectrum is concentrated at a certain frequency; If so, it is determined that the attack behavior shows the characteristics of segmented repetition in the intranet segment.

3. The method according to claim 2, characterized in that If the network segment in the intranet divided into fixed-length subnets is used as the target network segment, the certain frequency and the periodic repetition frequency of the fixed-length subnets in the target network segment have a power-of-2 relationship.

4. The method according to claim 1, characterized in that: The blocking data packet is constructed and sent out according to the number of IP addresses in each segment and the number of IP addresses in each fixed-length subnet to interrupt subsequent sessions and destroy the segment repetition characteristics or disrupt the IP address allocation rules of the IoT devices in each segment, including: The IP addresses that are repeated in the start and end IP addresses of each segment and the start and end IP addresses of each fixed-length subnet are regarded as high-risk IP addresses; If the number of IP addresses in each segment is the same as the number of IP addresses in each fixed-length subnet, extract the IP addresses in each fixed-length subnet and add them to the high-risk IP addresses; If the number of IP addresses in each segment is less than the number of IP addresses in each fixed-length subnet, calculate the similarity of IoT devices corresponding to the IP addresses at the same position in each segment, and add IP addresses with similarity higher than the set threshold to high-risk IP addresses; When attack behaviors with each high-risk IP address as the target address are detected again, other devices with the lowest similarity to the IoT devices of each high-risk IP address are selected, and blocking data packets are constructed and sent out according to the communication protocols of each other device.

5. According to the method of claim 4, the calculating the similarity of the IoT devices corresponding to the IPs at the same position in each segment comprises: Determine the similarity of known risks based on the vulnerability library or baseline standards of the two IoT devices; Determine the potential risk similarity according to the basic attributes of the two IoT devices, wherein the basic attributes include at least one of device purpose, device form, and device installation location; Based on the known risk similarity and the potential risk similarity, the comprehensive similarity of the two IoT devices is determined.

6. The method according to claim 1, characterized in that The blocking data packet is constructed and sent out according to the number of IP addresses in each segment and the number of IP addresses in each fixed-length subnet to interrupt subsequent sessions and destroy the segment repetition characteristics or disrupt the IP address allocation rules of the IoT devices in each segment, including: When the number of IP addresses in each segment is greater than or equal to the number of IP addresses in each fixed-length subnet, the endpoint IP addresses between adjacent segments are used as interference IP addresses; When an attack behavior with the interfering IP address as the target address is detected again, a blocking data packet is constructed and sent out according to the communication protocol of the Internet of Things device.

7. The method according to claim 1, characterized in that When an attack behavior is detected in the network traffic, a blocking data packet is constructed and sent out according to the characteristics of the IoT device to interrupt subsequent sessions, and further includes: In the case where a blacklisted access IP of an IoT device is detected in the network traffic, a session termination data packet is constructed and sent out according to the communication protocol of the IoT device to interrupt subsequent sessions.

8. An IoT security active defense device based on bypass mirroring, characterized in that: include: A traffic acquisition module is used to acquire the network traffic between the external device and the IoT device by means of bypass monitoring; An attack blocking module, used to construct and send a blocking data packet according to the characteristics of the IoT device to interrupt subsequent sessions when an attack behavior is detected in the network traffic; Specifically, when the intranet includes a fixed-length subnet, the distribution pattern of the attack behavior in the network traffic in the intranet segment is detected; if the attack behavior shows the characteristics of segmented repetition in the intranet segment, a blocking data packet is constructed and sent out according to the number of IP addresses in each segment and the number of IP addresses in each fixed-length subnet to interrupt subsequent sessions and destroy the segmented repetition characteristics or disrupt the IP address allocation pattern of the Internet of Things devices in each segment.

9. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the bypass mirror-based active Internet of Things security defense method described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by a processor, the bypass mirror-based active Internet of Things security defense method described in any one of claims 1-8 is implemented.

Images