Network intrusion detection and defense device and method based on distributed architecture

Abstract

The invention provides a network intrusion detection and defense device and method based on a distributed architecture, and belongs to the technical field of fingerprint identification, and the device collects network asset information based on tokens through a plurality of distributed nodes located in different isolation networks; the main node generates a plurality of tokens according to state information of a host system of each component in the trusted platform module, distributes the tokens to each distributed node, integrates and stores each piece of asset information, shares the asset information to a user, and determines intrusion equipment; the main node also changes the token when the network invades, prohibits the distributed nodes from collecting new information and retrieving the existing information, and defends the network invasion; and when the integrity of each host system is changed, the trusted platform module forbids the master node to receive or share asset information and defends network intrusion. According to the scheme, network intrusion detection and defense can be carried out under the condition of network isolation.

Description

Technical Field

[0001] The present application relates to the field of fingerprint recognition technology, and in particular to a network intrusion detection and defense device and method based on a distributed architecture. Background Art

[0002] Nowadays, cyber attacks are becoming more and more serious. In order to prevent cyber attacks, relevant experts have done a lot of research, some of which is aimed at monitoring the network. When managing the network security of an enterprise unit, a key aspect to consider is to accurately image its assets (such as network devices, servers, security devices, etc.), which are the most prominent targets of cyber attacks that try to exploit asset vulnerabilities.

[0003] In the prior art, the problem of network isolation is not considered when performing network intrusion detection and defense. Due to network isolation, most VLANs (Virtual Local Area Networks) cannot communicate with other VLANs, so the prior art is not suitable for application scenarios with multiple private networks.

[0004] Therefore, how to perform network intrusion detection and defense under network isolation has become an unresolved problem. Summary of the invention

[0005] The purpose of this application is to provide a network intrusion detection and defense device and method based on a distributed architecture, which can solve the problem in the prior art that network isolation is not considered when performing network intrusion detection and defense.

[0006] In a first aspect, an embodiment of the present application provides a network intrusion detection and defense device based on a distributed architecture, the device comprising: a plurality of distributed nodes, a master node, and a trusted platform module;

[0007] Multiple distributed nodes are located in different isolated networks. Each distributed node is used to detect network assets based on tokens allocated by the master node, collect asset information, and send asset information to the master node;

[0008] The master node is used to access the trusted platform module, generate multiple tokens according to the system status information, distribute the tokens to each distributed node, integrate and store each asset information, share the asset information with the user, and analyze the asset information to determine the device that invades the isolated network; the system status information is the status information of the host system of each component in the trusted platform module;

[0009] The master node is also used to change each token when a network intrusion occurs to each distributed node and / or the master node, so as to prohibit each distributed node from collecting new asset information and retrieving the collected asset information, so as to prevent network intrusion;

[0010] The trusted platform module is used to verify whether the integrity of each host system has changed. When the integrity of each host system has changed, the master node is prohibited from receiving or sharing asset information to prevent network intrusion.

[0011] In a possible implementation manner of the first aspect, each distributed node includes an agent module, the network assets include: network devices, servers, and security devices, and the asset information includes: an IP address, a MAC address, an operating system, a port list, a port status, and a list of services running on each port and their versions;

[0012] The proxy module is used to scan the network devices, servers and security devices connected to the corresponding isolated network, and collect the IP addresses, MAC addresses, operating systems, port lists, port status and service lists and versions running on each port of the network devices, servers and security devices respectively; the master node is also used to store copies of each proxy module.

[0013] In a possible implementation of the first aspect, each proxy module includes an open port detection model; the open port detection model is used to scan new devices connected to the corresponding isolated network when the corresponding distributed node detects a DHCP-ACK data packet, and send the obtained new device information to the master node;

[0014] The open port detection model is also used to scan the devices that have not issued the DHCP request when the corresponding distributed node queries the ARP cache table of the device that has not issued the DHCP request, and send the obtained device information to the master node;

[0015] The open port detection model is also used to scan each device connected to the corresponding isolated network according to a preset time frame when the corresponding distributed node obtains an ICMP echo reply message, to obtain device information or update the obtained device information; wherein, the ICMP echo reply message is: when the distributed node sends an ICMP echo request message to the IP address range of the isolated network, the message is obtained according to each IP address.

[0016] In a possible implementation of the first aspect, the master node includes: a relational database, an application programming interface, an access interface, and a data processing module; the relational database is used to store confirmation information provided by a user for scanning a predetermined network; the relational database is also used to store credentials of each distributed node and its associated token, and asset information sent by each distributed node;

[0017] The application programming interface includes a plurality of security endpoints, the application programming interface being used to send asset information collected by each distributed node to the access interface based on each security endpoint, and to retrieve each asset information;

[0018] The access interface is used to coordinate the information flow in the master node and regulate the information read and written in the relational database and the information processed by the data processing module; the access interface is also used to register each proxy module, generate tokens corresponding to each proxy module according to the system status information, and distribute tokens to each distributed node;

[0019] The data processing module is used to obtain the information provided by the access interface and send the obtained information to the relational database; the data processing module is also used to determine the port utilization pattern of the isolated network connection device and generate association rules between each port according to the association rule mining algorithm.

[0020] In a possible implementation of the first aspect, the data processing module includes a machine learning model, the machine learning model is generated based on the association rule, and the machine learning model is used to calculate the probability of occurrence of a port set for a given machine state;

[0021] The data processing module is also used to determine whether the port with the highest frequency in the scanning state exists in the devices connected to each isolated network after receiving the asset information. If not, a network intrusion alarm is generated; the data processing module is also used to derive association rules after receiving the scanning information; the scanning information is the asset information obtained by scanning a preset configured number of devices connected to each isolated network.

[0022] In a possible implementation of the first aspect, the master node also includes a network interface; the network interface is used to display the tokens assigned by the access interface to each distributed node so that each distributed node starts running; the network interface is also used to respond to the user's operation of granting access rights to a predetermined security endpoint to an external application based on the network interface, and display the token of the external application.

[0023] In a possible implementation of the first aspect, the network interface includes a visualization module; the visualization module is used to visualize each isolated network, network assets, and network intrusion alarms, and display the identity information of each isolated network connection device when a user clicks on an isolated network.

[0024] In a possible implementation of the first aspect, the trusted platform module includes: an input and output unit, a non-volatile storage unit, a platform identity authentication key, a plurality of platform configuration registers, and an application program;

[0025] An input / output unit, used to manage the data flow transmission between the various components in the trusted platform module, and also serves as an interface for the trusted platform module to interact with the external bus; a non-volatile storage unit, used to store the endorsement key, the storage root key, and the owner authorization data;

[0026] A platform identity authentication key is used for platform signature authentication; each platform configuration register is used to store system status measurements of each component in the trusted platform module during the host system startup process; an application is used to initialize the firmware of each component in the trusted platform module.

[0027] In a possible implementation of the first aspect, the trusted platform module further includes: an execution engine, a cryptographic accelerator engine, a random number generator, and a key generator; the execution engine is used to run the application; the cryptographic accelerator engine is used to perform symmetric cryptographic operations, asymmetric cryptographic operations, and cryptographic operations based on hash algorithms;

[0028] A random number generator is used to generate random numbers used for keys; a key generator is used to generate root keys based on a cryptographic accelerator engine and a random number generator.

[0029] In a possible implementation of the first aspect, the trusted platform module is also used to guide the host system of each component in the component sequence to check the configuration of the next component before transferring control to the trusted platform module; after performing the configuration check, the host system of each component sends a hash of the configuration data to each platform configuration register, and each platform configuration register stores the hash of the received configuration data.

[0030] In a possible implementation of the first aspect, the trusted platform module is further configured to update a corresponding platform configuration register based on a hash of data as the modification component; the hash of the data as the modification component is derived based on the following formula:

[0031] PCR i =SHA(Concatenation(PCR i ,SHA(modification)))

[0032] Among them, PCR i represents the i-th platform configuration register, SHA represents the secure hash function, Concatenation represents the association function, and modification represents the modification of the data hash;

[0033] The host system is used to verify the expected system state measurement value of each platform configuration register based on the original system state measurement value of each platform configuration register and the summary record generated by the modified data hash when power is turned on. If the expected value does not match the measured value, an error is generated, or an application programming interface, a corresponding token and a service using the token are disabled.

[0034] In a possible implementation of the first aspect, the master node is also used to periodically access each platform configuration register, retrieve system status measurement values ​​of the platform configuration registers in each host system, and track changes in each platform configuration register so that the trusted platform module can verify whether the integrity of each host system has changed.

[0035] In a possible implementation of the first aspect, the data processing module is also used to generate a corresponding new hash based on the information of each platform configuration register after the access interface accesses each platform configuration register, connect the new hash to the token associated with each credential, and compare the new hash with the original hash corresponding to the token; if the new hash does not match the original hash, prompt each host system to perform management.

[0036] In a second aspect, an embodiment of the present application provides a network intrusion detection and defense method based on a distributed architecture, which is implemented based on a network intrusion detection and defense device based on a distributed architecture in any one of the first aspects, and the method includes:

[0037] Based on the master node accessing the trusted platform module, multiple tokens are generated according to the system status information, and the tokens are allocated to each distributed node; the system status information is the status information of the host system of each component in the trusted platform module;

[0038] Based on each distributed node, detect network assets according to the tokens allocated by the master node, collect asset information, and send asset information to the master node;

[0039] Integrate and store asset information based on the master node, share asset information with users, and analyze asset information to identify devices that have invaded the isolated network;

[0040] At the same time, based on the master node, when network intrusion occurs in each distributed node and / or the master node, each token is changed to prohibit each distributed node from collecting new asset information and retrieving the collected asset information, so as to prevent network intrusion;

[0041] At the same time, based on the trusted platform module, it verifies whether the integrity of each host system has changed. When the integrity of each host system has changed, the master node is prohibited from receiving or sharing asset information to prevent network intrusion.

[0042] In a possible implementation of the second aspect, each distributed node includes an agent module, and the asset information includes: an IP address and a MAC address of the network asset; based on each distributed node, the network asset is detected according to a token allocated by the master node, and the asset information is collected, including:

[0043] Based on each proxy module, the network devices, servers and security devices connected to the corresponding isolated network are scanned; based on each proxy module, the IP addresses of the network devices, servers and security devices are collected; based on each proxy module, the address resolution protocol query is performed on the local ARP table to obtain the MAC address associated with the IP address.

[0044] In a possible implementation of the second aspect, each proxy module includes an open port detection model, and the asset information further includes: an operating system, a port list, a port status, and a list of services running on each port and their versions; based on each distributed node, the network assets are detected according to the token allocated by the master node, and the asset information is collected, further including:

[0045] Based on each open port detection model, the operating system, port list, port status, and service list and version running on each port of network devices, servers, and security devices are collected.

[0046] In a possible implementation of the second aspect, the master node includes a data processing module; analyzing the asset information based on the master node to determine the device that invades the isolated network includes:

[0047] Based on the data processing module, the port utilization pattern of the isolated network connection device is determined, and the association rules between the ports are generated according to the association rule mining algorithm; the device invading the isolated network is determined based on the association rules.

[0048] In a possible implementation of the second aspect, generating association rules between ports based on the data processing module and according to an association rule mining algorithm includes:

[0049] Calculate the frequency of one or more ports in the scanning state of each proxy module during the scanning process of the corresponding device; generate association rules based on the frequency, support and confidence of the port in the scanning state. The specific formula is as follows:

[0050]

[0051] Among them, 80 and 22 represent the remote connection ports of the isolated network connection device, 8080 represents the proxy service port, 23 represents the non-proxy service port in each distributed node, open means that the port is in the open state, filtered means that the port is in the deleted state during the iteration process of the association rule mining algorithm, support is the frequency of multiple ports being in the scanning state at the same time, and confidence is the ratio of the frequency of the superset of a port set being in the scanning state to the frequency of the port set being in the scanning state.

[0052] In a possible implementation of the second aspect, determining a device that invades an isolated network based on an association rule includes:

[0053] If port 80 and port 22 are open, export port 23 is open, and port 8080 is closed, it is determined that the device connected to port 23 is a device that has invaded the isolated network.

[0054] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the network intrusion detection and defense method based on a distributed architecture according to any one of the second aspects described above is implemented.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the network intrusion detection and defense method based on a distributed architecture according to any one of the second aspects above.

[0056] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the network intrusion detection and defense method based on a distributed architecture according to any one of the second aspects above.

[0057] The present application scheme collects network asset information based on tokens through multiple distributed nodes located in different isolated networks; the master node generates multiple tokens according to the status information of the host system of each component in the trusted platform module, distributes tokens to each distributed node, integrates and stores each asset information, shares asset information with users, and identifies intrusion devices; the master node also changes the token when the network is invaded, prohibits the distributed nodes from collecting new information and retrieving existing information, and defends against network intrusion; when the integrity of each host system changes, the trusted platform module prohibits the master node from receiving or sharing asset information to defend against network intrusion.

[0058] The present application scheme sets up distributed nodes in different isolated networks, and sets up a master node and a trusted platform module, so as to perform network intrusion detection and defense under network isolation, and has strong ease of use and practicality.

[0059] Other features and advantages of the present application will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0061] Figure 1 It is a schematic diagram of the technical route of fingerprint recognition provided by the embodiment of the present application;

[0062] Figure 2 It is a schematic diagram of the overall architecture of a network intrusion detection and defense device based on a distributed architecture provided in an embodiment of the present application;

[0063] Figure 3 It is a schematic diagram of the specific structure of a network intrusion detection and defense device based on a distributed architecture provided in an embodiment of the present application;

[0064] Figure 4 It is a schematic diagram of the overall structure of the trusted platform module provided in the embodiment of the present application;

[0065] Figure 5 This is a schematic diagram of the steps of a network intrusion detection and defense method based on a distributed architecture provided in an embodiment of the present application;

[0066] Figure 6 It is a schematic diagram comparing the execution time of the device and Nmap provided in the embodiment of the present application;

[0067] Figure 7 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0069] It should be understood that when used in this specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or photovoltaic components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, photovoltaic components and / or combinations thereof.

[0070] It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0071] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0072] As used in this specification and the appended claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0073] In addition, in the description of the present application, the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0074] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0075] Nowadays, cyber attacks are becoming more and more serious, and cyber security is the biggest risk faced by enterprises in the past few years. In order to prevent cyber attacks, relevant experts have done a lot of research, some of which aims to monitor the network and have a deep understanding of the devices and systems connected to the network and their characteristics, so that if new vulnerabilities are found in any of them, the affiliated units can immediately make decisions to prevent cyber incidents by exploiting the vulnerabilities at the root.

[0076] Currently, fingerprint technology is a common technology for collecting information about network devices, their characteristics, and their related services. Common application scenarios of fingerprint recognition technology include:

[0077] (1) Cyberspace search: Shodan is a popular cyberspace search engine that can scan protocols such as HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), SSH (Secure Shell), Telnet (Remote Login Protocol), SNMP (Simple Network Management Protocol) and SIP (Session Initialization Protocol), and identify all network devices by analyzing the information during the interaction between the client and the server.

[0078] Currently, the more popular threat perception system also uses fingerprint devices (fingerprint recognition device) technology to detect cyberspace devices.

[0079] (2) Asset management: In reality, system administrators rarely know all the information about assets, or they know the wrong information. This may be caused by the failure to update the information in a timely manner, the outsourcing of system maintenance, or the wrong configuration information provided by the equipment supplier. Therefore, it is necessary for the industrial control system to provide information to ensure efficient site-inspection so that the system administrator can accurately understand the relevant configuration information of the system.

[0080] (3) Intrusion detection: In theory, attackers can invade the industrial control system network by injecting commands or false data, causing catastrophic consequences such as large-scale power outages. Some equipment cannot be upgraded due to old age, and some equipment vendors do not even provide online upgrades and patches. It is particularly important for security personnel to be able to detect intrusions as early as possible.

[0081] The main work of fingerprint recognition is fingerprint extraction. Fingerprint extraction methods are mainly divided into two categories: active and passive. Active fingerprint extraction requires tools to actively scan the network system to obtain information, while passive fingerprint extraction methods passively monitor the network to obtain information with as little network intrusion as possible.

[0082] Generally, active fingerprint recognition has a higher probability of successfully identifying the system. This is because active recognition means collecting all the information required to generate a fingerprint, while passive recognition can only collect session channel information. However, active recognition does not work at all times. Probe scanning is more likely to cause network congestion and easy to be detected, and active recognition may not work at this time.

[0083] See also Figure 1 , Figure 1 Schematic diagram of the fingerprint recognition technology provided by the embodiment of the present application. Figure 1 As shown, the technical route of fingerprint recognition includes the following steps: data source identification, data collection, data storage and organization, data structure definition, data preprocessing, data classification, and result decision.

[0084] In the field of active fingerprint identification technology, Barroux JC proposed a method that uses Simple Network Management Protocol (SNMP) packets to collect information about devices in the network, and installs an agent in the selected nodes of each network through integrated resources. The agent sends the collected information back to the integrated resources, and the integrated resources collect and store the information. The installation of the agent is transparent to the user and is completed through remote procedure calls from the integrated resources to the selected nodes on each network.

[0085] However, this method may cause intrusion to the target device by remotely installing agent software in other devices, which brings certain risks. In addition, this method does not consider the problem of network isolation. Through network isolation, most VLANs cannot communicate with other VLANs.

[0086] Trabelsi Z introduced another method, which is not based on SNMP packets, but on Address Resolution Protocol (ARP) spoofing technology. By specifying a central host based on all traffic in the mandatory network, it enables it to detect all devices connected to the network. Although this method does not require unauthorized agent installation on remote devices, it cannot solve the above-mentioned port scanning and network isolation problems. More importantly, this method is not suitable for application scenarios with multiple private networks.

[0087] A very powerful model for actively scanning networks is Nmap (Network Mapper, a network scanning and sniffing toolkit under Linux), which is able to scan open ports and even infer the services and versions that may be running in the port. The main disadvantages of Nmap are that it cannot be used to scan networks with private IP addresses and it is a non-concurrent model. Despite these shortcomings, Nmap has been widely used for network inspections, such as scanning devices, operating systems, and open ports.

[0088] Yuan C introduced a model similar to Nmap that takes advantage of the powerful concurrency capabilities of the Golang programming language. Although this model is faster than the original Nmap considering its concurrency, it still has the limitation of not being able to scan networks with private IP addresses.

[0089] Regarding passive fingerprinting techniques, packet sniffing is the most widely used technique. Packet sniffing intercepts all traffic passing through the network, can decode the intercepted packets, and obtain data. This method can be used to discover assets in the network and can be used to prevent and detect intrusions in the network (such as detecting new IP address requests, etc.). Packet sniffing is also commonly used for network monitoring, such as Brattstrom M obtaining metrics in a specific network by sniffing SNMP packets.

[0090] When managing the network security of an enterprise organization, a key aspect to consider is to accurately image its assets (e.g., network devices, servers, security devices, etc.), which are the most prominent targets of network attacks that attempt to exploit asset vulnerabilities. Through imaging, the overall structure of the network and the specific configuration of the devices can be clearly understood, which helps with security management and troubleshooting.

[0091] In the prior art, the problem of network isolation is not considered when performing network intrusion detection and defense. Due to network isolation, most VLANs (Virtual Local Area Networks) cannot communicate with other VLANs, so the existing methods are not suitable for application scenarios with multiple private networks. Therefore, how to perform network intrusion detection and defense under network isolation has become a problem to be solved.

[0092] In response to the above-mentioned defects, an embodiment of the present application provides a network intrusion detection and defense device based on a distributed architecture, which collects network asset information based on tokens through multiple distributed nodes located in different isolated networks; the master node generates multiple tokens according to the status information of the host system of each component in the trusted platform module, distributes tokens to each distributed node, integrates and stores various asset information, shares asset information with users, and determines the intruding device; the master node also changes the token when the network is invaded, prohibits the distributed nodes from collecting new information and retrieving existing information, and defends against network intrusion; when the integrity of each host system changes, the trusted platform module prohibits the master node from receiving or sharing asset information to defend against network intrusion.

[0093] The present application scheme sets up distributed nodes in different isolated networks, and sets up a master node and a trusted platform module, so as to perform network intrusion detection and defense under network isolation, and has strong ease of use and practicality.

[0094] The specific process implemented by this application is introduced below through specific embodiments.

[0095] See also Figure 2 , Figure 2 Schematic diagram of the overall architecture of the network intrusion detection and defense device based on the distributed architecture provided by the embodiment of the present application. Figure 2 As shown, the device includes: a plurality of distributed nodes (Data Node, DN), a master node (Master Node, MN) and a trusted platform module (Trusted Platform Module, TPM).

[0096] It should be noted that this device is a dynamic network asset discovery model developed for discovering asset information of enterprise units. Due to network isolation, virtual local area networks (VLANs) cannot communicate with each other, and network intrusion detection and defense cannot be performed. By building a fully distributed architecture, the challenge of having isolated virtual local area networks in the same organization can be met.

[0097] A plurality of distributed nodes (1-n) are located in different isolated networks, and each distributed node is used to detect network assets based on tokens allocated by a master node, collect asset information, and send the asset information to the master node.

[0098] In some embodiments, the isolated network is a virtual local area network, and a distributed node is set in each virtual local area network. The distributed node running in each isolated network is responsible for discovering all assets associated with the network and sending all collected asset information to a central node (i.e., a master node, a central node). Then other applications or users (such as network administrators, network security analysts, etc.) can query all information in the master node to detect abnormal connections or traffic.

[0099] The master node is used to access the trusted platform module, generate multiple tokens based on the system status information, distribute tokens to each distributed node, integrate and store various asset information, share asset information with users, and analyze asset information to determine the device that invades the isolated network. Among them, the system status information is the status information of the host system of each component in the trusted platform module.

[0100] In some embodiments, all asset information collected by the distributed nodes is sent to the master node, which has access to all distributed nodes. Users and other applications interact with the master node.

[0101] It should be noted that the master node is the global coordinator of the system and is responsible for storing all asset information collected by distributed nodes. In addition, external applications and users retrieve information through the master node. The master node has the most critical functions. The master node contains a lot of information that may be used maliciously. The master node grants read and write (read and / or write) permissions to different users, services, and applications.

[0102] The master node is also used to change each token when a network intrusion occurs on each distributed node and / or the master node, so as to prohibit each distributed node from collecting new asset information and retrieving the collected asset information, so as to prevent network intrusion.

[0103] In one embodiment, if a node is damaged by a network attacker (i.e., hacked by a network intruder), the master node will take the initiative to change the token. After the token is changed, the distributed nodes cannot collect and store new asset information by detecting network assets, nor can they retrieve existing asset information. In this way, network intrusion can be better defended.

[0104] The trusted platform module is used to verify whether the integrity of each host system has changed. When the integrity of each host system has changed, the master node is prohibited from receiving or sharing asset information to prevent network intrusion.

[0105] It should be noted that TPM is a hardware device designed to provide hardware-based security functions to ensure platform integrity and secure key storage. TPM is part of a computer's trusted computing base (TCB), a collection of software and hardware components that execute its security policies.

[0106] In some embodiments, when using a continuous integration approach (integrating different VLAN data in the master node), the TPM can be used to ensure the integrity of source code and compiled binary files. This approach can be used in other environments to ensure the security of information stored in different platforms, not just the security of information stored in software repositories.

[0107] Given the sensitivity of the information collected by the master node, TPM is used to check whether its hardware and software have been changed. This capability ensures that the master node cannot receive or share information when the host system of the component is compromised. In this way, better defense can be provided against network intrusions.

[0108] See also Figure 3 , Figure 3 Schematic diagram of the specific structure of the network intrusion detection and defense device based on the distributed architecture provided by the embodiment of the present application. Figure 3 As shown, each distributed node includes an agent module, which is a kind of agent software, and the device on which the agent software is installed is a distributed node.

[0109] According to one embodiment of the present application, network assets include: network devices, servers and security devices, and asset information includes: the network asset's IP address (Internet Protocol Address), MAC address (Media Access Control Address), operating system, port list, port status, and a list of services running on each port and their versions.

[0110] In one embodiment, when a particular device is scanned by DN, the information collected from it is as follows: IP and MAC addresses, operating system, a list of ports in use (open ports) and their status, and where possible, a list of related services (in-use services) running on each port and their versions, as well as suspicious traffic on open ports or used ports.

[0111] The proxy module is used to scan the network devices, servers and security devices connected to the corresponding isolated network, and collect the IP addresses, MAC addresses, operating systems, port lists, port status, and service lists and versions running on each port of the network devices, servers and security devices. The master node is also used to store copies of each proxy module.

[0112] In one embodiment, the agent module can detect changes in the characteristics of existing devices (such as IP addresses, open ports, etc.) and quickly discover new devices connected to the network. A copy of each running agent software is stored in the MN. When a new DN is to be deployed, it connects to the MN to download a trusted copy of the agent software.

[0113] The agent software installed on a new DN is a trusted copy of the agent software installed on the original DN on the MN, for example Figure 3 There are 3 agent softwares in the MN, and there are 3 copies of the agent software on the MN. When the 4th DN is deployed, a copy of the agent software is connected to the MN to download, and the copy is distributed by the MN.

[0114] It should be noted that the agent software runs in each isolated network, and the installation of the agent software does not mean an unsupervised intrusion into the network, because the network administrator will register and authorize the agent software in each VLAN. Each agent software is responsible for discovering all devices connected to the VLAN that can be accessed from the DN, and then analyzing all traffic passing through the VLAN.

[0115] According to one embodiment of the present application, each proxy module includes an open port detection model (Nmap). The open port detection model is used to scan new devices connected to the corresponding isolated network when the corresponding distributed node detects a DHCP (Dynamic Host Configuration Protocol)-ACK (Acknowledge character) data packet, and send the obtained new device information to the master node.

[0116] The open port detection model is also used to scan the devices that have not issued a DHCP request when the corresponding distributed node queries the ARP cache table of the device that has not issued a DHCP request, and send the obtained device information to the master node.

[0117] In the prior art, when discovering network assets, new devices may connect to the network at any time. Since any new device may be a risk, it must be registered immediately after connecting to the network. DN captures DHCP traffic on each local network being monitored, and when a DHCP-ACK packet is detected, it stores the IP address, immediately scans its associated host with Nmap, and sends the resulting information to MN.

[0118] However, this approach does not provide a solution for devices that do not issue DHCP requests when a static IP address has already been assigned or when the device has been reconnected to the network and the previously received dynamic IP address has not expired.

[0119] In some embodiments, to solve this problem, the DN queries the ARP (Address Resolution Protocol) cache table of the device in a short period of time (e.g., every second) to check whether there is an IP address that has not been detected before. In this case, the DN will use Nmap to scan the device and send the collected device information to the MN.

[0120] The open port detection model is also used to scan each device connected to the corresponding isolated network according to a preset time frame when the corresponding distributed node obtains an ICMP (Internet Control Message Protocol) echo reply message to obtain device information or update the obtained device information. Among them, the ICMP echo reply message is: when the distributed node sends an ICMP echo request message to the IP address range of the isolated network, the message obtained according to each IP address.

[0121] It should be noted that although network assets have been registered, their related characteristics (such as open ports, etc.) will change over time. In some embodiments, in order to solve this problem (i.e., keep the discovered information up to date in real time), the DN performs network scanning in a preset time frame, and the length of the preset time frame can be configured by the network administrator.

[0122] This scanning process starts with DN sending an ICMP "echo request" message to all IP addresses of the network. When DN gets an ICMP "echo reply" message based on the IP address of the device, it uses Nmap to scan the device to discover or update device information.

[0123] In the prior art, network devices have been protected from scanning, and their assets cannot be obtained through Nmap or other similar models, or these devices do not respond to ICMP "echo request" messages. In one embodiment, to solve this problem, the DN is also configured to intercept all network traffic. After the DN connects to the network traffic, it scans the device and collects device information.

[0124] Finally, when DN completes the previous type of scan, it sends the device information to MN, which also includes the timestamps of the scan start and scan end. If the device information cannot reach MN for some reason (i.e., the connection is temporarily lost), the device information is temporarily stored in the embedded database of DN, and the device information will be retried periodically.

[0125] Please continue to see Figure 3 According to one implementation of the present application, the master node includes: a relational database, an application programming interface, an access interface, and a data processing module. Among them, the application programming interface is a REST API (Representational State Transfer Application Programming Interface), and the data processing module is the master node software.

[0126] The relational database is used to store confirmation information provided by the user for scanning a predetermined network. The relational database is also used to store the credentials of each distributed node and its associated token, as well as the asset information sent by each distributed node.

[0127] In some embodiments, the relational database is responsible for storing confirmation information of the networks to be scanned, which is directly provided by the network administrator, who first confirms which networks to scan. The relational database stores credential information, and the network administrator registers information about the DNs that will make up the entire distributed architecture on the server where the industrial control system is located, as well as the network IP addresses and masks of the VLANs to be scanned by each specific DN. When the relational database stores this information, it will also store the device information sent by the DN for each scan.

[0128] The application programming interface includes multiple security endpoints, and the application programming interface is used to send asset information collected by each distributed node to the access interface based on each security endpoint, and retrieve each asset information.

[0129] In some embodiments, DN, external applications and users communicate with MN through REST API, and API provides services based on REST architecture. A specific DN submits information about its related VLAN, and a specific external application accesses specific information.

[0130] In some embodiments, read and write operations involving MNs are accomplished by calling an API that provides secure access to information. The API contains multiple secure endpoints that are used to send and retrieve asset information. The API is protected in a token-based distributed architecture, where each participant has an API key that grants specific permissions to access specific secure endpoints and methods.

[0131] In some embodiments, token validation is performed prior to accessing specific functionality (e.g., DN access API, DN scanning device), so the token can be passed as a parameter to various secure endpoints.

[0132] The access interface is used to coordinate the flow of information in the master node and regulate the information read and written in the relational database and the information processed by the data processing module.

[0133] In some embodiments, the access interface acts as an intermediate layer between the API and other components of the MN. The access interface is responsible for coordinating the flow of information in the MN and regulating the information that can be read and written from the relational database and the information processed by the master node software. In this sense, the access interface provides secure access to the API through a token system.

[0134] The access interface is also used to register each proxy module, generate a token corresponding to each proxy module according to the system status information, and distribute the token to each distributed node.

[0135] In one embodiment, when a new agent software is registered in the access interface, the access interface generates a new token, which is used by the agent software when accessing the API.

[0136] The data processing module is used to obtain information provided by the access interface and send the obtained information to the relational database. The data processing module is also used to determine the port utilization mode of the isolated network connection device and generate association rules between various ports according to the association rule mining algorithm.

[0137] In some embodiments, the master node software is responsible for performing all data processing required before storing the information in the relational database. Specifically, the master node software obtains the information provided by the access interface and stores it in the relational database. The master node software is responsible for discovering the pattern of port utilization and using the Apriori algorithm (association rule mining algorithm) to find the association rules between ports.

[0138] According to one embodiment of the present application, the data processing module includes a machine learning model, which is generated based on association rules and is used to calculate the probability of occurrence of a port set for a given machine state.

[0139] In one embodiment, the master node software tracks the ports discovered by the DN in each scanning iteration and uses an association rule mining algorithm to generate an association rule-based machine learning model that calculates the likelihood (probability) of a specific set of ports (the set of ports in the device) appearing given a machine state.

[0140] The data processing module is also used to determine whether the port with the highest frequency in the scanning state exists in the devices connected to each isolated network after receiving the asset information, and if not, generate a network intrusion alarm. The data processing module is also used to derive association rules after receiving the scanning information, and the scanning information is the asset information obtained by scanning a preset number of devices connected to each isolated network.

[0141] In some embodiments, the master node software is responsible for analyzing the ports used in each device that has been detected, finding patterns of ports that are commonly used together, and sounding alarms when anomalies occur. After receiving the scan information, the master node software checks to see if the port with the highest probability of being operational exists in each device.

[0142] If not, an alarm will be generated and stored in the network interface (the network interface is introduced in the subsequent embodiments) and prompted. In addition, in order to continuously update according to actual conditions, the master node software derives association rules after receiving the scan information of a configurable number of devices.

[0143] Please continue to see Figure 3According to one embodiment of the present application, the master node further includes a network interface. The network interface is used to display the tokens allocated by the access interface to each distributed node so that each distributed node starts running. The network interface is also used to respond to the user's operation of granting access rights to a predetermined security endpoint to an external application based on the network interface, and display the token of the external application.

[0144] In some embodiments, the network interface is a Web (World Wide) interface, and the network administrator can use the Web interface to define the VLANs and existing DNs to be scanned. The network administrator communicates with the MN through the Web interface.

[0145] In some embodiments, the web interface is a web service for managing a distributed architecture. When a new DN is registered, the access interface assigns it a new token, which is displayed in the web interface so that the DN can start running.

[0146] In addition, network administrators can grant other applications access to specific secure endpoints of the API through the web interface. Similar to the case of DN, the web interface will display the token of the other application, and the other application will use the token when making requests to the API.

[0147] Please continue to see Figure 3 According to one embodiment of the present application, the network interface includes a visualization module. The visualization module is used to visualize each isolated network, network assets, and network intrusion alarms, and display the identity information of each isolated network connection device when the user clicks on an isolated network.

[0148] In some embodiments, the visualization module is used to check the status of the VLAN at any timestamp. The module allows the network administrator to visualize each VLAN, the network assets detected by the DN, and the alarms generated by the MN at a specific timestamp. If the user clicks on a specific VLAN, the VLAN is displayed on the visualization module, and the identity information such as the host name of each device is displayed.

[0149] See also Figure 4 , Figure 4 Schematic diagram of the overall structure of the trusted platform module provided in the embodiment of the present application. Figure 4 As shown, the trusted platform module includes: an input and output unit, a non-volatile storage unit, a platform identity authentication key (AIK, Attestation Identity Key), multiple platform configuration registers (PCR, Platform Configuration Registers) and an application.

[0150] The input and output unit is used to manage the data flow transmission between the various components in the trusted platform module, and serves as an interface for the trusted platform module to interact with the external bus. The non-volatile storage unit is used to store keys and owner authorization data. The keys include the endorsement key (EK) and the storage root key (SRK).

[0151] The platform authentication key is a special-purpose RSA key (public key, asymmetric key) in the TPM, which is mathematically related to the EK and is used for platform signature authentication. Each platform configuration register provides a cryptographic way to record the state of the software and is used to store system state measurements during the host system startup process of each component in the trusted platform module. The application is used to initialize the firmware of each component in the trusted platform module.

[0152] Please continue to see Figure 4 According to one embodiment of the present application, the trusted platform module also includes: an execution engine, a cryptographic accelerator engine (ie, a SHA-1 engine, an RSA engine), a random number generator, and a key generator.

[0153] The execution engine is used to run applications, and the cryptographic accelerator engine is used to perform symmetric cryptographic operations, asymmetric cryptographic operations, and cryptographic operations based on hash algorithms. The random number generator is used to generate high-quality random numbers used for keys, and the key generator is used to generate root keys based on the cryptographic accelerator engine and the random number generator.

[0154] According to an embodiment of the present application, the trusted platform module is also used to guide the host system of each component in the component sequence to check the configuration of the next component before transferring control to the trusted platform module. After performing the configuration check, the host system of each component sends a hash of the configuration data to each platform configuration register, and each platform configuration register stores the hash of the received configuration data.

[0155] In some embodiments, the role of the TPM in the TCB is to ensure its trustworthiness by performing checks on the components booting, with each component in the boot sequence checking the next component before passing control to it. After each individual check, each component sends a hash to the TPM, which is stored in its platform configuration registers.

[0156] The TPM reflects changes in the integrity of the host system during its lifetime, enabling the host system to perform a configuration check during each power-on state. If the host system is not intact, then the configuration check cannot be performed.

[0157] According to an embodiment of the present application, the trusted platform module is further used to update the corresponding platform configuration register based on the hash of the data as the modification component. The hash of the data as the modification component is derived based on the following formula:

[0158] PCR i =SHA(Concatenation(PCR i ,SHA(modification)))

[0159] Among them, PCR i represents the i-th platform configuration register, SHA (Secure Hash Algorithm) represents a secure hash function, Concatenation represents an association function, and modification represents a modification of data hash.

[0160] The host system is used to verify the expected system state measurement value of each platform configuration register based on the original system state measurement value of each platform configuration register and the summary record generated by the modified data hash when powered on. If the expected value does not match the measured value, an error is generated, or the application programming interface, the corresponding token and the service using the token are disabled.

[0161] In some embodiments, by saving the original PCR state and the summary record generated by the modified data hash, the host system can verify the expected new value of the PCR at power up. If the expected new value does not match the original system state measurement of the stored PCR, an error is generated or specific functions are disabled, such as disabling an API.

[0162] According to one embodiment of the present application, the master node is also used to periodically access each platform configuration register, retrieve the system status measurement value of the platform configuration register in each host system, and track the changes in each platform configuration register so that the trusted platform module can verify whether the integrity of each host system has changed.

[0163] In some embodiments, the MN is able to monitor whether the integrity of the host system has changed based on its ability to access the PCRs through the access interface at execution time. The MN tracks potential hardware changes that occur in PCRs 0 to 7, as these changes may reveal hardware configuration changes in the host system.

[0164] According to one embodiment of the present application, the data processing module is also used to generate a corresponding new hash based on the information of each platform configuration register after the access interface accesses each platform configuration register, connect the new hash to the token associated with each credential, and compare the new hash with the original hash corresponding to the token. If the new hash does not match the original hash, the host system is prompted to perform management.

[0165] In some embodiments, after the MN accesses the PCR through the access interface, the master node software will generate a hash based on the information of the PCR. The hash will be connected to the token associated with each credential present in the application database (relational database).

[0166] These tokens can be divided into two categories, and the master node software is able to verify the integrity of the host system every time it retrieves the status of the PCR from the host system. By hashing the newly obtained PCR and comparing it with the existing PCR hash corresponding to its token, in the case of a mismatch between them, the host system is informed of their modification, prompting the host system to manage this situation and disable the corresponding tokens and the services using these tokens until the situation is resolved or verified.

[0167] See also Figure 5 , Figure 5 Schematic diagram of the steps of the network intrusion detection and defense method based on the distributed architecture provided by the embodiment of the present application. The method is implemented based on the network intrusion detection and defense device of the distributed architecture, such as Figure 5 As shown, the method includes:

[0168] S501, based on the master node accessing the trusted platform module, generating multiple tokens according to system status information, and distributing the tokens to each distributed node; the system status information is the status information of the host system of each component in the trusted platform module.

[0169] It should be noted that the specific implementation principle of this embodiment has been described in the above embodiment and will not be repeated here.

[0170] S502, based on each distributed node, detect network assets according to the token allocated by the master node, collect asset information, and send the asset information to the master node.

[0171] According to an embodiment of the present application, each distributed node includes an agent module, and the asset information includes: the IP address and MAC address of the network asset. Based on each distributed node, the network asset is detected according to the token allocated by the master node, and the asset information is collected, which may include the following steps:

[0172] Based on each proxy module, scan the network devices, servers and security devices connected to the corresponding isolated network. Based on each proxy module, collect the IP addresses of network devices, servers and security devices. Based on each proxy module, perform an address resolution protocol query on the local ARP table to obtain the MAC address associated with the IP address.

[0173] In some embodiments, to collect asset information, the first feature identified for each device is the IP address. The MAC address associated with the IP address is then obtained by performing an address resolution protocol query on the local ARP table.

[0174] According to an implementation of the present application, each proxy module includes an open port detection model, and the asset information also includes: operating system, port list, port status, and service list and version running on each port. Based on each distributed node, the network assets are detected according to the token allocated by the master node, and the asset information is collected, and the following steps may also be included:

[0175] Based on each open port detection model, the operating system, port list, port status, and service list and version running on each port of network devices, servers, and security devices are collected.

[0176] In some embodiments, the remaining asset information (except IP address, MAC address) can be discovered by using Nmap model. Thus, Nmap model is used to retrieve the operating system, port list, port status and the list of services running on each port and their versions from the scanned device if possible.

[0177] S503, integrating and storing various asset information based on the master node, sharing the asset information with users, and analyzing the asset information to determine the device that invades the isolated network.

[0178] According to an embodiment of the present application, the master node includes a data processing module. Analyzing asset information based on the master node to determine the device that invades the isolated network may include the following steps:

[0179] Based on the data processing module, the port utilization pattern of the isolated network connection device is determined, and the association rules between the ports are generated according to the association rule mining algorithm. The device that invades the isolated network is determined based on the association rules.

[0180] According to an implementation of the present application, based on the data processing module, generating association rules between various ports according to the association rule mining algorithm may include the following steps:

[0181] Calculate the frequency of one or more ports in the scanning state of each proxy module during the scanning process of the corresponding device. Generate association rules based on the frequency, support and confidence of the port in the scanning state. The specific formula is as follows:

[0182]

[0183] Among them, 80 and 22 represent the remote connection ports of the isolated network connection device, 8080 represents the proxy service port, 23 represents the non-proxy service port in each distributed node, open means that the port is in the open state, filtered means that the port is in the deleted state during the iteration process of the association rule mining algorithm, support is the frequency of multiple ports being in the scanning state at the same time, and confidence is the ratio of the frequency of the superset of a port set being in the scanning state to the frequency of the port set being in the scanning state.

[0184] In some embodiments, the Apriori algorithm is used to find the association rules between ports. For this reason, the frequency of each port occurrence (the frequency in the scanning state) is first calculated, and then the frequency of each pair of ports and the frequency of every three ports are calculated. The frequency of multiple ports can also be calculated.

[0185] During this execution, if the port tuple (set) does not obtain a frequency greater than the preset threshold, the superset of the set (the set that already includes the ports in the tuple) will not make the algorithm more efficient. In other words, the set is a non-frequent itemset and there is no need to calculate the support of the set. The preset threshold is called support, which can be set to 0.5 in the proposed distributed architecture.

[0186] Another parameter of the algorithm is confidence, which indicates the relative support of the entire rule relative to the support of the preceding rule. In the proposed distributed architecture, the confidence can be set to 0.98. Among them, support indicates the probability of two or more ports appearing at the same time. Confidence indicates the ratio of the probability of two or more ports appearing at the same time to the probability of a single port appearing, or the ratio of the probability of multiple ports appearing at the same time to the probability of several ports appearing at the same time.

[0187] According to an implementation of the present application, determining a device that invades an isolated network based on an association rule may include the following steps:

[0188] If port 80 and port 22 are open, export port 23 is open, and port 8080 is closed, it is determined that the device connected to port 23 is a device that has invaded the isolated network.

[0189] In one embodiment, if the status of ports 80 and 22 of a device is set to open, but port 8080 is not in use and the status of port 23 is open, two alarms are generated: one alarm indicates that port 8080 is not in use and is likely being used by a network intruder, and the other alarm indicates that the status of port 23 is not the expected status.

[0190] It should be noted that ports 80 and 22 are remote connection ports and need to be accessed through the proxy service port 8080. You should not log in directly remotely through port 23. If the status of port 23 is open, it can be determined that the device connected to port 23 is a device that has invaded the isolated network.

[0191] S504, at the same time, based on the master node, when network intrusion occurs in each distributed node and / or the master node, each token is changed to prohibit each distributed node from collecting new asset information and retrieving the collected asset information to prevent network intrusion.

[0192] S505, at the same time, based on the trusted platform module, check whether the integrity of each host system has changed. When the integrity of each host system has changed, prohibit the master node from receiving or sharing asset information to prevent network intrusion.

[0193] It should be noted that steps S503 to S505 are executed simultaneously.

[0194] In some embodiments, the process of testing and verifying the network intrusion detection and defense device based on the distributed architecture provided by the embodiments of the present application is as follows:

[0195] By discovering assets connected to isolated networks, not only can unauthorized connections be identified, but also their characteristics and potential vulnerabilities that may exist. There are some problems with current asset discovery models.

[0196] The present application creates a set of new components based on the Nmap model, which have some specific functions. The following will analyze some of these features from a qualitative and quantitative perspective. Table 1 is a qualitative comparison of the functions between the present application and Nmap.

[0197] Table 1

[0198]

[0199]

[0200]

[0201] In some embodiments, the complexity of the present application solution is evaluated as follows:

[0202] The present application scheme is based on a distributed architecture and can scan different devices by applying Nmap to each VLAN. In the prior art, when Nmap is running, it may not be possible to detect the devices connected and disconnected in the network. However, the present application scheme can detect them by performing self-organizing scans on these devices using the traffic sniffing function.

[0203] In some embodiments, time and space complexity are important factors in the evaluation. The present device and Nmap are executed simultaneously in the same application scenario and the two are compared. For this evaluation, 6 different execution application scenarios are preset, and the present device and Nmap are executed simultaneously in different application scenarios.

[0204] Application scenario 1 (S1): 1 VLAN and 2 static machines (devices in network assets), application scenario 2 (S2): 1 VLAN and 5 static machines, application scenario 3 (S3): 1 VLAN and 10 static machines, application scenario 4 (S4): 3 VLANs, VLAN 1 contains 1 static machine, VLAN 2 contains 3 static machines, VLAN 3 contains 2 static machines and 2 DHCP machines.

[0205] Application scenario 5 (S5): 3 VLANs, VLAN 1 contains 2 static machines, VLAN 2 contains 6 static machines, VLAN 3 contains 4 static machines and 3 DHCP machines; Application scenario 6 (S6): 3 VLANs, VLAN 1 contains 4 static machines, VLAN 2 contains 10 static machines, VLAN 3 contains 6 static machines and 4 DHCP machines.

[0206] Each machine had a different configuration (operating system, open ports and services). Static machines were always connected to a VLAN, while DHCP machines were connected dynamically at a specific moment of the scanning process. For each application scenario, Nmap and the distributed nodes of the installation were executed 20 times to obtain statistically significant results. In each execution, the following parameters were measured:

[0207] (1) Time (in seconds): The time required for the device to perform the corresponding VLAN scan. In application scenarios 4, 5, and 6, each VLAN measures this parameter independently, and different measurement results will be compared among these VLANs because different VLANs may take different times due to network load.

[0208] (2) Maximum virtual memory (in megabytes): the maximum amount of memory consumed by the process executing this device, (3) Minimum virtual memory (in megabytes): the minimum amount of memory consumed by the process executing this device, (4) Average virtual memory (in megabytes): the average amount of memory consumed by the process executing this device.

[0209] (5) Number of ports / services found in each machine: The number of ports found in each machine and their numbers. First, measure the number of devices detected; second, compare the results based on the number of ports / services found.

[0210] To measure execution time, the date command was run before and after executing the device (the difference between these values ​​provides the execution time). To measure memory values, the PID (Process Identifier) ​​of each process was obtained and then the / proc (process) / <PID> / status file was periodically queried.

[0211] See also Figure 6 , Figure 6 : is a schematic diagram comparing the execution time of the device and Nmap provided in the embodiment of the present application. Figure 6 Figure 2 shows the execution time of the device (yellow) and Nmap (blue) according to the number of ports in each application scenario and VLAN.

[0212] The device and Nmap each contain a trend line, when there are fewer ports (i.e., less than about 9), Nmap takes less time than the device, and when there are more ports, the device is faster (i.e., the device takes less time than Nmap) due to the parallelism of the device. Therefore, the device is suitable for scanning a large enough number of ports.

[0213] The present application scheme collects network asset information based on tokens through multiple distributed nodes located in different isolated networks; the master node generates multiple tokens according to the status information of the host system of each component in the trusted platform module, distributes tokens to each distributed node, integrates and stores each asset information, shares asset information with users, and identifies intrusion devices; the master node also changes the token when the network is invaded, prohibits the distributed nodes from collecting new information and retrieving existing information, and defends against network intrusion; when the integrity of each host system changes, the trusted platform module prohibits the master node from receiving or sharing asset information to defend against network intrusion.

[0214] The present application scheme sets up distributed nodes in different isolated networks, and sets up a master node and a trusted platform module, so as to perform network intrusion detection and defense under network isolation, and has strong ease of use and practicality.

[0215] The present application scheme has the following innovations in asset discovery and processing of discovered information: it solves the network isolation problem in medium and large networks, uses TPM technology to enhance the security of collected information, and adopts artificial intelligence algorithms to detect suspicious patterns in port usage; analyzes the time series generated by traffic in each port, detects traffic peaks, and warns users when abnormal peaks are detected.

[0216] The information collected by this device and the features it possesses were compared with Nmap, and the results showed that this device has better capabilities than Nmap and can scan larger networks faster.

[0217] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0218] See also Figure 7 , Figure 7 Schematic diagram of the structure of the electronic device 7 provided in the embodiment of the present application. Figure 7 As shown, the electronic device 7 of this embodiment includes: at least one processor 701 ( Figure 7 Only one is shown in the figure), a memory 703, and a computer program 702 stored in the memory 703 and executable on at least one processor 701, and when the processor 701 executes the computer program 702, the steps in the above method embodiment are implemented.

[0219] The electronic device 7 may be a computing device such as a desktop computer, a notebook, a PDA, or a mobile phone. The electronic device 7 may include, but is not limited to, a processor 701 and a memory 703. Those skilled in the art will appreciate that Figure 7 It is only an example of the electronic device 7 and does not constitute a limitation on the electronic device 7. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0220] The processor 701 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware photovoltaic modules, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0221] In some embodiments, the memory 703 may be an internal storage unit of the electronic device 7, such as a hard disk or memory of the electronic device 7. In other embodiments, the memory 703 may also be an external storage device of the electronic device 7, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital card (SecureDigital, SD), a flash card (Flash Card), etc. equipped on the electronic device 7. Further, the memory 703 may also include both an internal storage unit of the electronic device 7 and an external storage device. The memory 703 is used to store an operating system, an application program, a boot loader (Boot Loader), data, and other programs, such as program codes of computer programs, etc. The memory 703 may also be used to temporarily store data that has been output or is to be output.

[0222] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, when the present application implements all or part of the processes in the above-mentioned embodiment method, it can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps applied to the method embodiment can be implemented. Among them, the computer program includes a computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable storage medium may at least include: any entity or device that can carry the computer program code to the computing device / electronic device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, a computer-readable storage medium cannot be an electric carrier signal and a telecommunication signal.

[0223] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0224] An embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the steps in the above-mentioned method embodiments.

[0225] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0226] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0227] In the embodiments provided in the present application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. The device / electronic device embodiments described above are merely schematic, and the division of the above modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or photovoltaic components can be combined or integrated into another system, and some features can be ignored and not executed. Another point is that the indirect coupling, direct coupling or communication connection between each other shown or discussed can be an indirect coupling, direct coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0228] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0229] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A network intrusion detection and defense device based on a distributed architecture, characterized in that: The device comprises: a plurality of distributed nodes, a master node and a trusted platform module; A plurality of distributed nodes are located in different isolated networks, each distributed node is used to detect network assets based on tokens allocated by the master node, collect asset information, and send the asset information to the master node; The master node is used to access the trusted platform module, generate multiple tokens according to the system status information, distribute tokens to each distributed node, integrate and store each asset information, share the asset information with the user, and analyze the asset information to determine the device that invades the isolated network; the system status information is the status information of the host system of each component in the trusted platform module; The master node is further used to change each token when a network intrusion occurs in each distributed node and / or the master node, so as to prohibit each distributed node from collecting new asset information and retrieving the collected asset information, so as to prevent network intrusion; The trusted platform module is used to verify whether the integrity of each host system has changed. When the integrity of each host system has changed, the master node is prohibited from receiving or sharing asset information to prevent network intrusion.

2. The network intrusion detection and defense device based on a distributed architecture according to claim 1, characterized in that: Each distributed node includes an agent module. Network assets include: network devices, servers, and security devices. Asset information includes: IP addresses, MAC addresses, operating systems, port lists, port status, and service lists and versions running on each port. The proxy module is used to scan the network devices, servers and security devices connected to the corresponding isolated network, and collect the IP addresses, MAC addresses, operating systems, port lists, port status, and service lists and versions running on each port of the network devices, servers and security devices; The master node is also used to store copies of each proxy module.

3. The network intrusion detection and defense device based on distributed architecture according to claim 1, characterized in that: Each proxy module includes an open port detection model; An open port detection model, used for scanning new devices connected to the corresponding isolated network when the corresponding distributed node detects a DHCP-ACK data packet, and sending the obtained new device information to the master node; The open port detection model is also used to scan the device that has not issued the DHCP request when the corresponding distributed node queries the ARP cache table of the device that has not issued the DHCP request, and send the obtained device information to the master node; The open port detection model is also used to scan each device connected to the corresponding isolated network according to a preset time frame when the corresponding distributed node obtains an ICMP echo reply message, and obtain device information or update the obtained device information; The ICMP echo reply message is a message obtained according to each IP address when the distributed node sends an ICMP echo request message to the IP address range of the isolated network.

4. The network intrusion detection and defense device based on a distributed architecture according to claim 2, characterized in that: The master node includes: a relational database, an application programming interface, an access interface and a data processing module; The relational database is used to store confirmation information provided by the user for scanning a predetermined network; the relational database is also used to store the credentials of each distributed node and its associated token, and the asset information sent by each distributed node; The application programming interface includes a plurality of security endpoints, and the application programming interface is used to send asset information collected by each distributed node to the access interface based on each security endpoint, and retrieve each asset information; The access interface is used to coordinate the information flow in the master node and regulate the information read and written in the relational database and the information processed by the data processing module; the access interface is also used to register each proxy module, generate a token corresponding to each proxy module according to the system status information, and distribute the token to each distributed node; The data processing module is used to obtain the information provided by the access interface and send the obtained information to the relational database; the data processing module is also used to determine the port utilization pattern of the isolated network connection device and generate association rules between each port according to the association rule mining algorithm.

5. The network intrusion detection and defense device based on distributed architecture according to claim 4 is characterized in that: The data processing module includes a machine learning model, the machine learning model is generated based on the association rule, and the machine learning model is used to calculate the probability of occurrence of a port set for a given machine state; The data processing module is further used to determine whether the port with the highest frequency in the scanning state exists in each isolated network connected device after receiving the asset information, and if not, generate a network intrusion alarm; The data processing module is further used to derive the association rule after receiving scanning information; the scanning information is asset information obtained by scanning a preset configured number of devices connected to each isolated network.

6. The network intrusion detection and defense device based on distributed architecture according to claim 5, characterized in that: The master node also includes a network interface; The network interface is used to display the tokens allocated by the access interface to each distributed node so that each distributed node starts running; the network interface is also used to respond to the user's operation of granting access rights to a predetermined security endpoint to an external application based on the network interface, and display the token of the external application.

7. The network intrusion detection and defense device based on distributed architecture according to claim 6, characterized in that: The network interface includes a visualization module; The visualization module is used to visualize each isolated network, network assets and the network intrusion alarm, and when the user clicks on an isolated network, display the identity information of each isolated network connection device.

8. The network intrusion detection and defense device based on distributed architecture according to claim 4, characterized in that: The trusted platform module includes: an input and output unit, a non-volatile storage unit, a platform identity authentication key, a plurality of platform configuration registers and an application program; The input-output unit is used to manage the data flow transmission between the various components in the trusted platform module and serve as an interface for the trusted platform module to interact with the external bus; the non-volatile storage unit is used to store the endorsement key, the storage root key and the owner authorization data; The platform identity authentication key is used for platform signature authentication; each platform configuration register is used to store system status measurement values ​​of each component in the trusted platform module during the host system startup process; the application is used to initialize the firmware of each component in the trusted platform module.

9. The network intrusion detection and defense device based on distributed architecture according to claim 8, characterized in that: The trusted platform module also includes: an execution engine, a cryptographic accelerator engine, a random number generator, and a key generator; The execution engine is used to run the application; the cryptography accelerator engine is used to perform symmetric cryptography operations, asymmetric cryptography operations, and cryptography operations based on hash algorithms; The random number generator is used to generate random numbers used for keys; the key generator is used to generate a root key based on the cryptography accelerator engine and the random number generator.

10. The network intrusion detection and defense device based on distributed architecture according to claim 9, characterized in that: The trusted platform module is further used to direct the host system of each component in the component sequence to check the configuration of the next component before passing control to the trusted platform module; After performing the configuration check, the host system of each component sends a hash of the configuration data to each platform configuration register, and each platform configuration register stores the hash of the received configuration data.

11. The network intrusion detection and defense device based on distributed architecture according to claim 10, characterized in that: The trusted platform module is further used to update the corresponding platform configuration register based on the hash of the data as the modification component; the hash of the data as the modification component is derived based on the following formula: PCR i =SHA(Concatenation(PCR i ,SHA(modification))) Among them, PCR i represents the i-th platform configuration register, SHA represents the secure hash function, Concatenation represents the association function, and modification represents the modification of the data hash; The host system is used to verify the expected system state measurement value of each platform configuration register based on the original system state measurement value of each platform configuration register and the summary record generated by the modified data hash when powered on. If the expected value does not match the measured value, an error is generated, or the application programming interface, the corresponding token and the service using the token are disabled.

12. The network intrusion detection and defense device based on distributed architecture according to claim 8, characterized in that: The master node is also used to periodically access each platform configuration register, retrieve system status measurement values ​​of the platform configuration register in each host system, and track changes in each platform configuration register so that the trusted platform module can verify whether the integrity of each host system has changed.

13. The network intrusion detection and defense device based on distributed architecture according to claim 8, characterized in that: The data processing module is also used to generate a corresponding new hash based on the information of each platform configuration register after the access interface accesses each platform configuration register, connect the new hash to the token associated with each credential, and compare the new hash with the original hash corresponding to the token. If the new hash does not match the original hash, prompt each host system to perform management.

14. A network intrusion detection and defense method based on a distributed architecture, characterized in that: The network intrusion detection and defense device based on a distributed architecture according to any one of claims 1 to 13 is implemented, and the method comprises: Based on the master node accessing the trusted platform module, generating multiple tokens according to system status information, and distributing tokens to each distributed node; the system status information is the status information of the host system of each component in the trusted platform module; Based on each distributed node, detect network assets according to the tokens allocated by the master node, collect asset information, and send the asset information to the master node; Integrate and store asset information based on the master node, share asset information with users, and analyze asset information to identify devices that have invaded the isolated network; At the same time, based on the master node, when network intrusion occurs in each distributed node and / or the master node, each token is changed to prohibit each distributed node from collecting new asset information and retrieving the collected asset information, so as to prevent network intrusion; At the same time, based on the trusted platform module, it is checked whether the integrity of each host system has changed. When the integrity of each host system has changed, the master node is prohibited from receiving or sharing asset information to prevent network intrusion.

15. The network intrusion detection and defense method based on distributed architecture according to claim 14, characterized in that: Each distributed node includes an agent module, and the asset information includes: the IP address and MAC address of the network asset; based on each distributed node, the network asset is detected according to the token allocated by the master node, and the asset information is collected, including: Based on each proxy module, scan the network devices, servers and security devices connected to the corresponding isolated network; Based on each proxy module, collect the IP addresses of network devices, servers and security devices; Based on each proxy module, an address resolution protocol query is performed on the local ARP table to obtain the MAC address associated with the IP address.

16. The network intrusion detection and defense method based on distributed architecture according to claim 15, characterized in that: Each proxy module includes an open port detection model. Asset information also includes: operating system, port list, port status, and service list and version running on each port; based on each distributed node, network assets are detected according to the token allocated by the master node, and asset information is collected, including: Based on each open port detection model, the operating system, port list, port status, and service list and version running on each port of network devices, servers, and security devices are collected.

17. The network intrusion detection and defense method based on distributed architecture according to claim 15, characterized in that: The master node includes a data processing module; Analyze asset information based on the master node to identify devices that have invaded the isolated network, including: Based on the data processing module, determine the port utilization pattern of the isolated network connection device, and generate association rules between the ports according to the association rule mining algorithm; A device intruding the isolated network is determined based on the association rule.

18. The network intrusion detection and defense method based on distributed architecture according to claim 17, characterized in that: Based on the data processing module, association rules between ports are generated according to an association rule mining algorithm, including: Calculate the frequency of one or more ports being in the scanning state in each proxy module during the process of scanning the corresponding device; The association rule is generated according to the frequency, support and confidence of the port in the scanning state. The specific formula is as follows: Among them, 80 and 22 represent the remote connection ports of the isolated network connection device, 8080 represents the proxy service port, 23 represents the non-proxy service port in each distributed node, open means that the port is in the open state, filtered means that the port is in the deleted state during the iteration process of the association rule mining algorithm, support is the frequency of multiple ports being in the scanning state at the same time, and confidence is the ratio of the frequency of the superset of a port set being in the scanning state to the frequency of the port set being in the scanning state.

19. The network intrusion detection and defense method based on distributed architecture according to claim 18, characterized in that: Determining a device that invades the isolated network based on the association rule includes: If port 80 and port 22 are open, export port 23 is open, and port 8080 is closed, it is determined that the device connected to port 23 is a device that has invaded the isolated network.

20. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the network intrusion detection and defense method based on a distributed architecture described in any one of claims 14-19 is implemented.

21. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network intrusion detection and defense method based on a distributed architecture described in any one of claims 14 to 19 is implemented.

Images