Automatic dynamic security disposal method and system based on multi-technology fusion

Abstract

The invention discloses an automatic dynamic security disposal method and system based on multi-technology fusion, and relates to the technical field of network security, and the method comprises the steps: collecting flow data based on a security disposal unit; constructing a security policy library; and selecting and executing a security policy according to the abnormal traffic characteristics. According to the method disclosed by the invention, by constructing the security policy library, integration and management of various security policies are realized, diversified solutions are provided for coping with different network threats, the defense capability of network security is enhanced, the flexibility of coping with complex network attacks is improved, the risk of failure of a single policy is reduced, and the security of the network is improved. By selecting and executing the security policy, the level of overall security protection is improved, differentiated processing of different attack traffic is realized, network attacks are accurately attacked, malicious traffic is effectively isolated, normal services are protected from being affected, and better effects are achieved in the aspects of efficiency, adaptability and security.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an automated dynamic security handling method and system based on multi-technology integration. Background Art

[0002] Globally, cyber attacks on key infrastructure such as electricity are frequent, posing a serious threat to national security and social stability. In particular, with the rapid development of smart grids, the informatization and networking of power grid systems are constantly improving, and new security vulnerabilities are constantly being discovered and exploited, making the security situation of power grid networks increasingly severe. Existing network security technologies are unable to cope with the increasingly complex network security challenges. How to achieve comprehensive management of power network security has become an important issue that needs to be urgently addressed in the field of power network security.

[0003] There are many deficiencies in the existing network security disposal methods, which are mainly reflected in the following aspects: singleness. The current security disposal methods are often designed for specific problems and lack comprehensiveness. For example, some patent applications only provide blacklist security disposal measures, while others only focus on traffic traction security disposal operations. Single disposal measures are difficult to cope with complex and changeable network attacks; inability to integrate. Existing network security equipment or systems often cannot achieve effective integration, resulting in the need to adopt separate deployment and separate operations when facing multiple security disposal needs, which not only increases the operation and maintenance costs, but also may lead to security protection loopholes; slow response speed. When facing complex network attacks, existing technologies often cannot achieve rapid response. Due to the lack of unified scheduling between security equipment or systems, the disposal efficiency is low, and it is difficult to contain attacks and reduce losses in a short time; insufficient early warning capabilities. When analyzing network traffic, existing technologies can often only identify known attack features, and have weak early warning capabilities for unknown attacks or variant attacks; poor system compatibility. There are compatibility issues between network security equipment or systems of different manufacturers and models, which makes it difficult to give full play to the overall advantages in actual applications; too much manual intervention. In the actual operation process, existing technologies often require a lot of manual intervention, which not only increases the workload, but also may lead to misoperation. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problems solved by the present invention are: the existing network security handling methods are single, cannot be integrated, and have slow response speeds, and how to achieve comprehensive, efficient, and rapid management of power network security.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: an automated dynamic security disposal method based on the integration of multiple technologies, comprising collecting traffic data based on a security disposal unit; building a security policy library; and selecting and executing security policies based on abnormal traffic characteristics.

[0007] As a preferred solution of the automated dynamic security disposal method based on multi-technology integration described in the present invention, the security disposal unit includes a blacklist module, a traffic traction module, a traffic control module, an automatic orchestration module, a scheduling module, a traffic packet analysis module and an information extraction module.

[0008] As a preferred solution of the automated dynamic security handling method based on multi-technology integration described in the present invention, the collection of traffic data includes the security handling unit collecting network traffic data through monitoring devices deployed in the network, and performing preliminary analysis and extracting key information to form data packets.

[0009] As a preferred solution of the automated dynamic security handling method based on multi-technology integration described in the present invention, wherein: the construction of the security policy library includes a blacklist policy, a traffic traction policy and a traffic control policy.

[0010] As a preferred solution of the automated dynamic security disposal method based on multi-technology integration described in the present invention, wherein: the construction of the security policy library also includes blacklist strategy using IP blocking; traffic traction strategy includes honeypot diversion, custom status code, redirection and delayed response; traffic control strategy includes rate limitation, concurrent connection number limitation and bandwidth control.

[0011] As a preferred solution of the automated dynamic security handling method based on multi-technology integration described in the present invention, wherein: the selection of security policies and execution includes analyzing attack traffic characteristics to select security policies.

[0012] As a preferred solution of the automated dynamic security disposal method based on multi-technology integration described in the present invention, the selection and execution of security policies also includes: if the source IP address of the attack traffic belongs to the blacklist, the blacklist policy is executed; if the attack traffic is non-blacklist traffic, the traffic traction policy is executed; if the attack traffic is normal business traffic, the traffic control policy is executed.

[0013] Another object of the present invention is to provide an automated dynamic security handling system based on the integration of multiple technologies, which can select and execute security policies according to abnormal traffic characteristics through an integrated security policy execution mechanism, thereby solving the problems that current network security handling technologies contain single handling measures, the inability to effectively coordinate between handling units, and slow response speed.

[0014] As a preferred solution of the automated dynamic security disposal system based on multi-technology integration described in the present invention, it includes: a traffic collection module, a security policy module, and a policy execution module; the traffic collection module is used to collect traffic data based on the security disposal unit, and perform preliminary analysis and extract key information to form a data packet; the security policy module is used to build a security policy library, including blacklist policies, traffic traction policies, and traffic control policies; the policy execution module is used to select and execute security policies based on abnormal traffic characteristics.

[0015] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a step of an automated dynamic security disposal method based on multi-technology fusion.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an automated dynamic security disposal method based on multi-technology fusion.

[0017] Beneficial effects of the present invention: The automated dynamic security disposal method based on the integration of multiple technologies provided by the present invention realizes real-time monitoring and preliminary processing of network traffic by collecting traffic data based on a security disposal unit, provides an accurate data basis for subsequent security policy execution, improves the real-time response capability of network security and the pertinence and efficiency of security disposal, reduces invalid operations, reduces the consumption of network resources, and ensures the effectiveness of subsequent security policies. By building a security policy library, it realizes the integration and management of multiple security policies, provides diversified solutions for coping with different network threats, enhances the defense capability of network security, improves the flexibility of coping with complex network attacks, and reduces the risk of failure of a single policy. By selecting and executing security policies, it realizes rapid identification and response to attack traffic, shortens the security response time, reduces the workload of security operation and maintenance personnel, and improves the overall security protection level. By judging the source IP address of the attack traffic and executing the corresponding policy, it realizes differentiated processing of different attack traffic, accurately strikes network attacks, effectively isolates malicious traffic, and protects normal business from being affected. The present invention achieves better results in terms of efficiency, adaptability and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1An overall flow chart of an automated dynamic security disposal method based on multi-technology integration is provided for the first embodiment of the present invention.

[0020] Figure 2 A schematic diagram of the composition of a WEB dynamic defense device based on an automated dynamic security handling method integrating multiple technologies provided in the first embodiment of the present invention.

[0021] Figure 3 A schematic diagram of the structure of a security handling unit of an automated dynamic security handling method based on multi-technology integration provided in the first embodiment of the present invention.

[0022] Figure 4 A schematic diagram of the workflow of a security handling unit of an automated dynamic security handling method based on multi-technology integration provided in the first embodiment of the present invention.

[0023] Figure 5 A schematic diagram of a blacklist adding process of an automated dynamic security disposal method based on multi-technology integration provided in the first embodiment of the present invention.

[0024] Figure 6 A schematic diagram of a blacklist interception process of an automated dynamic security disposal method based on multi-technology integration provided in the first embodiment of the present invention.

[0025] Figure 7 A schematic diagram of a blacklist interception process of an automated dynamic security disposal method based on multi-technology integration provided in the first embodiment of the present invention.

[0026] Figure 8 A schematic diagram of the flow traction working process of an automated dynamic security disposal method based on multi-technology integration provided in the first embodiment of the present invention.

[0027] Fig. 9 A schematic diagram of the working process of a traffic traction module of an automated dynamic security disposal method based on multi-technology integration provided in the first embodiment of the present invention.

[0028] Fig.10 A schematic diagram of the flow control working process of an automated dynamic safety disposal method based on multi-technology integration is provided for the first embodiment of the present invention.

[0029] Fig.11 A schematic diagram of the working process of a flow control module of an automated dynamic safety disposal method based on multi-technology integration provided in the first embodiment of the present invention.

[0030] Fig.12 A defense disposal application scenario diagram of an automated dynamic security disposal method based on multi-technology integration provided in the first embodiment of the present invention.

[0031] Fig.13 A system and equipment deployment diagram of an automated dynamic security disposal method based on multi-technology integration is provided for the second embodiment of the present invention.

[0032] Fig.14 A blacklist module activation blocking script diagram of an automated dynamic security disposal method based on multi-technology integration is provided in accordance with the second embodiment of the present invention.

[0033] Fig.15 A diagram of experimental results of a blacklist module of an automated dynamic security disposal method based on multi-technology integration provided in the second embodiment of the present invention.

[0034] Fig.16 A honeypot drainage experiment setup diagram for an automated dynamic security disposal method based on multi-technology integration provided in the second embodiment of the present invention.

[0035] Fig.17 A diagram showing the results of a honeypot drainage experiment for an automated dynamic security disposal method based on multi-technology integration provided in the second embodiment of the present invention.

[0036] Fig.18 A diagram of the results of a custom status code experiment for an automated dynamic security handling method based on multi-technology integration provided in the second embodiment of the present invention.

[0037] Fig.19 A redirection experiment result setting diagram of an automated dynamic security disposal method based on multi-technology fusion provided in the second embodiment of the present invention.

[0038] Fig. 20 A delayed response experiment setup diagram for an automated dynamic security disposal method based on multi-technology fusion provided in the second embodiment of the present invention.

[0039] Fig.21 A graph showing the delayed response experimental results of an automated dynamic safety disposal method based on multi-technology integration provided in the second embodiment of the present invention.

[0040] Fig. 22 An experimental setup diagram of a flow control module for an automated dynamic safety disposal method based on multi-technology integration provided in the second embodiment of the present invention.

[0041] Fig.23 A diagram of experimental results of a flow control module of an automated dynamic safety disposal method based on multi-technology integration provided in the second embodiment of the present invention.

[0042] Fig.24A schematic diagram of the modules of an automated dynamic safety disposal system based on multi-technology integration provided for the third embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0044] Example 1, reference Figure 1-Figure 12 , which is an embodiment of the present invention, provides an automated dynamic security disposal method based on multi-technology integration, including:

[0045] S1: Collect traffic data based on the security disposal unit.

[0046] Furthermore, the security handling unit includes a blacklist module, a traffic traction module, a traffic control module, an automatic orchestration module, a scheduling module, a traffic packet analysis module and an information extraction module.

[0047] It should be noted that collecting traffic data includes the security handling unit collecting network traffic data through monitoring devices deployed in the network, and performing preliminary analysis and extracting key information to form data packets.

[0048] It should also be noted that the security processing unit of the present invention can call a variety of security devices to enhance the security of the network, including but not limited to Web application firewalls, cloud access security agents, and IPS intrusion prevention systems, etc. In this embodiment, the security processing unit is set in the WEB application firewall, such as Figure 2 As shown, the WEB application firewall is equipped with four network cards. Network card A is connected to the network, so that the WEB application firewall is connected to the network to monitor and collect network data; the network data monitored and collected by the network card is analyzed and processed by the security disposal unit to obtain element data; network card B and network card D are physically connected to transmit element data to network card D through network card B, and network card D then transmits the received element data to the security disposal unit to form a disposal strategy; network card C is connected to the network, and the disposal strategy is issued to each network security device through the network, network card A, network card B, network card C and network card D, at least network card A is an inline mode monitoring network card with network monitoring function; network card A is the monitoring service entrance of the WEB application firewall; network card B is the monitoring service exit of the WEB application firewall; network card D is the traffic disposal entrance of the WEB application firewall; network card C is the traffic disposal exit of the WEB application firewall, and sends security policy data information.

[0049] It should also be noted that if Figure 3 As shown, the security handling unit is connected to firewall B, and then connected to the business system. At the same time, the security handling unit is connected to firewall A, and then connected to the terminal; the security handling unit, business system, terminal, firewall A, and firewall B are connected to the same network through a network connection. The security handling unit can control firewall A and firewall B through the network and issue policies. At the same time, it can monitor and collect data in the network; the security handling unit can be connected in series in the network or in a bypass connection through a device.

[0050] The security handling unit first analyzes and extracts information from the access traffic information monitored by firewall B and firewall A through the traffic packet analysis and information extraction module, and matches the data frame IP address obtained after decoding with the blacklist IP address. If the match is successful, the interception module is called for interception. If the match is not successful, the data frame IP address obtained after decoding is transmitted to other handling modules for further identification and handling. The blacklist control module is also connected to the automatic orchestration module, and the blacklist in the blacklist control module is used to form a corresponding security script through the automatic orchestration module. Finally, the corresponding security equipment in the security script is controlled through the mobilization module connected to the automatic orchestration module, and the blacklist is issued and collected. Operation.

[0051] It should also be noted that the workflow of the safety disposal unit is as follows: Figure 4 As shown, when a traffic request occurs, the traffic request is received through the monitoring network card. The next step is to parse the received traffic packet, extract information, forward the data packet, and then perform blacklist IP matching and interception operations on the received data packet, and forward the traffic that does not need to be intercepted. The next step is to perform traffic traction or traffic control strategy formation on the received forwarded traffic, and finally complete the corresponding security disposal operation.

[0052] It should also be noted that the blacklist module, which forms the blacklist data information by adding blacklists through various channels, issues the blacklist data of the managed security devices through the security disposal unit, and updates the blacklist data of the security devices to make them consistent with the blacklist data in the blacklist module. The static blacklist of a single device is transformed into a function with dynamic blacklist generation. The blacklist data in the blacklist module can be added by collecting and summarizing the blacklist data of the connected security devices through the security disposal unit, and can also be added to the blacklist module manually, and can also be added to the blacklist data in the module by connecting to the corresponding threat alarm data.

[0053] It should also be noted that the blacklist addition process is as follows Figure 5As shown, after obtaining the blacklist IP, the blacklist module first adds the blacklist IP address to the blacklist file, updates the blacklist file, and provides it for the security disposal unit to call and perform IP blocking operations. Then the blacklist module queries the security devices in the automatic orchestration module, screens out the security devices with blacklist functions, and then forms a script for issuing the updated blacklist operation through the automatic orchestration module. Then, the scheduling module executes the corresponding issuance operation, and finally implements the blacklist issuance update operation for each security device that needs to update the blacklist.

[0054] On the other hand, when a network security device with a blacklist function controlled by a WEB application firewall is subjected to abnormal traffic or attacks, it adds a new blacklist IP formed after its own alarm strategy operation, completes the blocking of the blacklist IP through the blacklist module, and further sends the updated blacklist file through the security disposal unit, thereby updating the blacklist of the controlled network security device with a blacklist function. The blacklist adding function can make the network security device with a blacklist function controlled by the WEB application firewall consistent with the blacklist used in the WEB application firewall.

[0055] It should also be noted that, by collecting traffic data based on the security disposal unit, the present invention realizes in-depth analysis of network traffic and extraction of key information, provides accurate data support for subsequent security policy execution, improves the detection rate of network security incidents and reduces the false alarm rate, and enhances the overall defense capability of the network. In the process of connecting the security disposal unit to firewall B and then to the business system, the present invention ensures that the security disposal unit can monitor and protect the business system in real time, builds a multi-level, comprehensive network security protection system, improves the security of the business system, ensures business continuity and data security, and the blacklist module adds blacklists through various channels, realizes dynamic update and management of blacklist data, timely blocks emerging network threats, enhances the network's ability to resist new attacks, shortens security response time, and improves the network's security protection level. The network security device with blacklist function controlled by the WEB application firewall ensures the synchronization of blacklist information of the entire network security device cluster, realizes unified security policy deployment and execution, simplifies the security management process, and improves the efficiency and consistency of security management.

[0056] S2: Build a security policy library.

[0057] Furthermore, a security policy library is constructed including blacklist policies, traffic traction policies, and traffic control policies.

[0058] It should be noted that building a security policy library also includes blacklist strategies using IP blocking; traffic traction strategies include honeypot diversion, custom status codes, redirection and delayed response; traffic control strategies include rate limiting, concurrent connection number limiting and bandwidth control.

[0059] It should also be noted that the blacklist module completes IP blocking through blacklist interception. The blacklist interception process is as follows: Figure 6 As shown, after the security handling unit is deployed in the network through the WEB application firewall, when the traffic access request passes through the security handling unit first, the security handling unit will take the lead in performing a blacklist interception operation. When the traffic access request passes through a network device security device with a blacklist handling function, the network security device will take the lead in performing a blacklist interception operation. Through the blacklist adding operation, the network security devices with blacklist functions connected to the WEB application firewall in the entire network are consistent with the blacklist used in the WEB application firewall. Therefore, it can be achieved that no matter where in the network under the control of the WEB application firewall, access from a blacklisted IP address can be intercepted by the network security device with a blacklist interception function or the WEB application firewall that is connected to it, so as to detect and intercept as early as possible and reduce the risk of intrusion.

[0060] It should also be noted that the traffic traction module manages the diversion target site through the diversion target site management module, analyzes the abnormal traffic, extracts conditional data, and then sets the diversion strategy based on the extracted conditional data. The diversion strategy setting methods include custom status codes, redirection, delayed response, and honeypot diversion. Among them, honeypot diversion uses honeypot management to uniformly maintain and control the honeypot to complete the simulation object system information setting.

[0061] It should also be noted that, by constructing a security policy library, the present invention implements predefined response measures for network security incidents, provides decision support for real-time network security protection, improves the processing speed and accuracy of security incidents, and reduces the need for human intervention. In the blacklist interception process, the security disposal unit and the network security device with blacklist function work together to ensure that no matter where the attack comes from, it can be discovered and intercepted in time, building a network security protection network with no blind spots, reducing the risk of network intrusion, and realizing refined management of abnormal traffic through the diversion target site management module and honeypot management, enhancing the network's ability to resist advanced persistent threats. The present invention constructs a comprehensive defense framework to cope with diverse network security threats. Through predefined strategies, the system can quickly identify and respond to known attack patterns, thereby improving defense efficiency. The design of the policy library allows administrators to dynamically adjust defense strategies based on real-time threat intelligence and business needs to maintain the best protection status. Through precise strategies Slightly configured, it can reduce false alarm events and ensure that only real threats are intercepted, thereby reducing the impact on normal business. By blocking known malicious IPs, known attack sources can be immediately blocked, reducing the time the network is exposed to risks. Blacklist management provides administrators with a simple way to maintain network security and reduces the need for complex configuration. The traffic traction strategy can lure attackers into a controlled environment through technologies such as honeypot diversion, thereby protecting the real system from damage. By analyzing the traffic diverted to the honeypot, the attacker's behavior patterns can be collected to provide intelligence support for future defense. The traffic control strategy can prevent network resources from being over-consumed by limiting the rate and bandwidth of abnormal traffic and ensure the stable operation of the network. By controlling the number of concurrent connections, DoS attacks can be effectively defended to ensure the availability of services. The present invention not only improves the protection capability of network security by constructing a library containing multiple security policies, but also provides strong technical support for achieving efficient and flexible network security management.

[0062] S3: Select and execute security policies based on abnormal traffic characteristics.

[0063] Furthermore, security policies are selected and executed including analyzing attack traffic characteristics to select security policies.

[0064] It should be noted that selecting and executing a security policy also includes, if the source IP address of the attack traffic is on the blacklist, executing the blacklist policy; if the attack traffic is not on the blacklist, executing the traffic diversion policy; if the attack traffic is normal business traffic, executing the traffic control policy.

[0065] It should also be noted that the blacklist strategy uses blacklist interception. The blacklist interception process for an access request is as follows: Figure 7As shown, after the WEB application firewall is started, the security disposal unit begins to perform initialization settings. The first step is to configure the blacklist file. First, save the corresponding blacklist IP in the specified blacklist file. In the configuration file, specify the blacklist file path to complete the configuration of the blacklist file. The second step is to load the blacklist IP. When the security disposal unit is initialized, the loading of the blacklist IP is completed according to the blacklist file path according to the corresponding configuration file specified in the first step. The third step is packet capture. The network card is monitored in inline mode to capture the data packets arriving at the network card, and then the data packets are preliminarily parsed for the corresponding content of the data frame to obtain the initial parsed data packet. The fourth step is deep packet decoding. The initial parsed data packet is deep packet decoded to obtain the IP address of the data frame. The decoding order of deep packet decoding is: link layer> network layer> transport layer. The fifth step is blacklist matching, blocking Intercept, match the data frame IP address obtained after decoding with the blacklist IP address. If the match is successful, the interception module is called for interception, and the blacklist interception operation of an access request is completed. If the match is not successful, the data frame IP address obtained after decoding is transmitted to other disposal modules for further identification and disposal. The sixth step is interception. After the interception module receives the interception request, it will intercept the corresponding data frame and cut off the communication. In the fifth step, after the data frame IP address obtained after decoding is transmitted to other disposal modules, the blacklist interception of an access request is completed. At this time, the WEB application firewall continues to parse, match, and intercept the next access request. In the sixth step, the interception module is called for interception, and the blacklist interception of an access request is completed. At this time, the WEB application firewall continues to parse, match, and intercept the next access request.

[0066] It should also be noted that the traffic traction strategy is implemented, and the traffic traction process is as follows: Figure 8 As shown, the access traffic is parsed by the traffic analysis and information extraction modules, and then the parsed data packets are first sent to the blacklist module for disposal, and the access IPs in the blacklist are intercepted. For the access IPs that are not in the blacklist, the traffic data packets are forwarded to the traffic traction module for disposal. The traffic traction module tractions the traffic to the business system or honeypot system, or marks the status code, redirects, or delays the response according to the configured traction strategy.

[0067] The working process of the traffic traction module is as follows Fig. 9As shown, after receiving the traffic forwarded by the blacklist module, the traffic traction module identifies the normal business traffic and the specific traffic through the traffic identification and determination module. On the one hand, the traffic identification and determination module forwards the normal business traffic to the site management module, and then pulls the normal business traffic to the target business system through the site management module. On the other hand, the identified specific traffic is forwarded to the policy configuration module. The policy configuration module configures the traction policy according to the element data in the specific traffic, and then pulls the specific traffic to the honeypot system according to the policy, or marks the status code, redirects, or performs a delayed response operation. The traction policy configuration module comprehensively considers the element data such as the target IP, the target port, and the alarm type, and then sets different traction policies. At the same time, in a network containing more than one honeypot system, the honeypot system set in the network can be uniformly configured and managed through the honeypot management module. When the traction policy configuration module configures the traction policy of the honeypot, it can directly call the policy setting in the honeypot traction module. The honeypot management module can uniformly manage the honeypot system set in the network and set the system information of the simulated object.

[0068] When the source IP hits the honeypot diversion strategy, the honeypot target address proxy is executed, and the access traffic is directly reverse-proxied to the honeypot server, providing an easy target for attackers. Since the honeypot does not provide truly valuable services to the outside world, all attempts on the honeypot are considered suspicious. At the same time, it delays the attacker's attack on the real target, making the attacker waste time on the honeypot, thereby protecting the corresponding business system.

[0069] When the source IP hits the custom status code strategy, the pre-set custom status code is returned. When the source IP hits the forwarding strategy, the response attack traffic is forwarded to a blank server or other security devices such as honeypots for further processing based on the IP address information, so as to prevent the corresponding attack traffic from flowing into the business system to protect the business system from infringement. Traffic forwarding includes: forwarding the domain name / IP to the local port; forwarding the domain name / IP to another domain name / IP; forwarding the local port to another port; forwarding the local port to another domain name / IP.

[0070] When the source IP hits the redirection strategy, a new redirected URL address is returned. The request can be redirected to the home page or to other custom pages. For redirection processing, various operations are relatively sophisticated, which can prevent the business system from being affected by attack traffic without affecting the normal operation of the business system.

[0071] When the source IP hits the delayed response strategy, the access is delayed by setting the response time. When the client IP is directly added to the attack IP list for disposal, it is easy to generate false alarms or do not want the attacker to realize that he has been discovered. In this case, the delayed response is used to deliberately delay the response time of these requests, reduce the attacker's request speed, and create a time window for identifying user behavior, thereby more accurately and effectively resolving possible network attacks.

[0072] It should also be noted that the flow control strategy is implemented, and the flow control process is as follows Fig.10 As shown, the access traffic is first intercepted by the blacklist control module, and then the traffic that needs to be forwarded is forwarded to the traffic control module for rate limitation, concurrent connection number limitation, and bandwidth control. Finally, the traffic after traffic control by the traffic control module is sent to the corresponding normal business system or the corresponding honeypot system.

[0073] The working process of the flow control module is as follows Fig.11 As shown, the traffic forwarded by the blacklist module includes specific traffic and normal business traffic. The specific traffic is the traffic that needs to be handled securely, and the normal business traffic is the traffic that accesses the normal business system. The specific traffic and the normal business traffic are then set according to the policy in the control module to complete rate limitation, concurrent connection number limitation, and bandwidth control. Finally, the controlled traffic is forwarded to the corresponding target address, that is, the honeypot system or the normal business system. The policy settings in the traffic control module can be flexibly set according to the needs of the corresponding honeypot system or the normal business system.

[0074] It should also be noted that security policies are selected and executed, and dynamic security disposal methods are realized through dynamic defense devices. The application scenarios of defense disposal are as follows: Fig.12As shown, first, the dynamic defense device is deployed, and the security control center and the business center are connected through firewall I. The dynamic defense device is deployed in series at the system area boundary on the business company side, behind firewall I. One end of the dynamic defense device is connected to user terminal III through firewall III, and the other end is connected to business system I. Firewall IV is deployed on one end of the business system, and firewall I is connected to firewall IV. Business system II on the security control center side is connected to firewall I through firewall II. Then, the attack scenario is simulated. On the business company side, the virus of user terminal III attacks the business system I of the business company through the business terminal III of the business company, and then attacks the business system II of the security control center; the attacker II of the business company attacks the business system I of the business company and then attacks the business system II of the security control center; on the security control center side, the attacker I attacks the business system I of the security control center through the terminal of the security control center, and then attacks the business system II of the business company. Finally, the security disposal effect is achieved through serial deployment to achieve traffic packet blocking, and through linkage blocking, the firewall of the security control center is managed, etc., to perform linkage blocking of IPs, and through traffic control, the flow limit of each IP is achieved, and then the overall flow limit is completed.

[0075] It should also be noted that according to the characteristics of abnormal traffic, security policies are selected and executed, which realizes the automation of security protection. By analyzing the traffic characteristics in real time, the system can quickly identify and respond to emerging security threats, thereby greatly shortening the response time. The selection mechanism can customize the response strategy according to the specific characteristics of the attack, improve the accuracy and effectiveness of protection, and reduce false alarms through precise feature analysis to avoid unnecessary interference with normal business. By analyzing the characteristics of attack traffic to select security policies, the system can adaptively adjust the policy according to changes in attack traffic and keep the protection measures synchronized with the threat. By deeply analyzing the attack traffic, the behavior pattern of the attacker can be more fully understood, thereby deepening the defense level. If the source IP address of the attack traffic belongs to the blacklist, the blacklist policy is executed, and the system can quickly Block known threats. For known malicious source IPs, the system can immediately execute the blacklist strategy to effectively block their further activities. By timely intercepting blacklist traffic, network resources can be protected from abuse and network stability can be maintained. If the attack traffic is not blacklisted traffic, the traffic traction strategy is executed. The system can trap and analyze unknown threats. For abnormal traffic that is not on the blacklist, its intentions and behaviors can be further analyzed by technical means such as traction of traffic to honeypots to provide intelligence for future defense. By diverting suspicious traffic to a safe area, the real business system can be protected from being affected and business continuity can be ensured. The present invention not only improves the automation level of network security protection by selecting security policies and executing key steps, but also provides strong technical support for achieving efficient and flexible network security management.

[0076] Example 2, reference Figure 13-Figure 23 , which is an embodiment of the present invention, provides an automated dynamic safety disposal method based on multi-technology integration. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0077] 1. Experimental Preparation

[0078] First, deploy the system and equipment. Fig.13 As shown, the test terminal and the upstream service are connected through a common firewall. The dynamic defense device host reverse proxy is deployed at the system area boundary on the upstream service side, behind the common firewall. The host business network card is enabled by default. The backup host is deployed using the same method and IP. The backup host business network card is disabled by default. One end of the dynamic defense device uses a business switch to connect to the test terminal through the firewall, and the other end is connected to the upstream service.

[0079] Next, prepare the scripts and security plug-ins required for the blacklist module experiment. The blacklist module realizes the synchronous update of the blacklist of related security devices. It needs to be controlled by the network security devices with blacklist function through the WEB application firewall, and write the script for synchronizing the blacklist of related security devices through the automatic arrangement module script library function. Then, when the blacklist module updates the blacklist, it will schedule the module to execute the corresponding distribution operation. Finally, when the blacklist module updates the blacklist, it will synchronously update the blacklist of related security devices. Therefore, when conducting the blacklist module experiment, it is necessary to create a script for synchronously updating related security devices. The logic is that when the blacklist module updates the blacklist, the preset operation in the script is executed through the scheduling module, the security device is logged in, and the blacklist function of the security device is entered to update the blacklist of the security device synchronously.

[0080] The script for the blacklist module to synchronously update related security devices requires the support of the security plug-in function. The specific operations are as follows: Step 1, create a plug-in for logging in to the security device. In the plug-in content, select the network security device with blacklist function controlled by the WEB application firewall to specify the device for synchronizing the blacklist. Select the login action, enter the code correctly in the editor, fill in the remaining fields correctly and save. Step 2, create a plug-in for synchronizing the blacklist of security devices. In the plug-in content, select the network security device with blacklist function controlled by the WEB application firewall to specify the device for synchronizing the blacklist. Select the atomic action, enter the code correctly in the editor, fill in the remaining fields correctly and save.

[0081] Finally, the honeypot management module data required for the traffic traction module experiment is used. Through the honeypot management module, the honeypot system set up in the network can be uniformly configured and managed. When the traction strategy configuration module configures the traction strategy of the honeypot, it can directly call the policy settings in the honeypot traction module. Therefore, when conducting the traffic traction module experiment, it is necessary to set the upstream business as the simulated object, that is, the honeypot of the upstream service.

[0082] 2. Experimental Execution

[0083] (1) Blacklist module experiment

[0084] Add a blacklist, synchronize security devices, and block access traffic. First, log in to the dynamic defense system and enter the intelligent orchestration-script library function. Next, Fig.14 As shown, check and enable the blocking script. Next, enter the automatic disposal-blacklist function and add the blacklist correctly. Next, check the relevant security devices to see if the blacklist is added synchronously. Finally, as shown Fig.15 As shown, the IP client accesses the upstream service end system.

[0085] After analysis, the experimental results are in line with expectations. Through the blacklist addition operation, the network security devices with blacklist function connected to the WEB application firewall in the entire network are consistent with the blacklist used in the WEB application firewall. In the network under the control of the WEB application firewall, the devices and systems in the network accessed by the blacklist IP can be successfully intercepted by the network security device with blacklist interception function or the WEB application firewall connected to it.

[0086] (2) Traffic traction - honeypot diversion experiment

[0087] Configure policies to pull specific traffic to the target business system to the honeypot. First, log in to the dynamic defense system. Next, Fig.16 As shown, enter the automatic disposal-response strategy function, add a strategy, set up honeypot diversion, and divert the access of the specified source IP to the honeypot. Finally, as shown Fig.17 As shown, when the client to which the source IP belongs accesses the business system, the honeypot is successfully diverted and the interface is displayed as a simulated honeypot.

[0088] After analysis, the experimental results are in line with expectations. By setting a response strategy, the non-blacklisted traffic that accesses the business system and hits the source IP can be successfully reverse-proxied to the honeypot server, making it impossible for attackers to attack the real business system targets, thereby achieving the goal of protecting the actual business system.

[0089] (3) Traffic traction - custom status code experiment

[0090] Configure the policy to return a pre-set custom status code for specific traffic accessing the target business system. First, log in to the dynamic defense system. Next, enter the automatic disposal-response policy function, add a policy, set a custom status code, set a custom status code 501 for access to the specified source IP, upload the blocking page correctly, and finally, Fig.18 As shown, when the client to which the source IP belongs accesses the business system, the interface status code is correct and the interface shows the manual upload interface.

[0091] After analysis, the experimental results are in line with expectations. By setting the response strategy, the non-blacklisted traffic that accesses the business system and hits the source IP can be successfully responded to according to the strategy, and the response interface and status code returned are correct.

[0092] (4) Traffic traction-redirection experiment

[0093] Configure policies to redirect specific traffic requests to the target business system to a custom page. First, log in to the dynamic defense system. Next, Fig.19 As shown in the figure, enter the automatic disposal-response strategy function, add a strategy, set a custom redirect address, and redirect the access of the specified source IP to https: / / 192.168.30.111:8443 / login.html?lang=zh_CN, with a status code of 301. Finally, the client to which the source IP belongs accesses the business system, and the redirection is successful, with a correct status code.

[0094] After analysis, the experimental results are in line with expectations. By setting a response strategy, we can successfully respond to non-blacklist traffic that accesses the business system and hits the source IP according to the strategy, and return the redirection set by the policy to the custom page, so that the business system is not responded to by the attack traffic and does not affect the normal operation of the business system, thereby achieving the purpose of protecting the business system.

[0095] (5) Traffic traction-delay response experiment

[0096] Configure policies to delay responses to specific traffic requests accessing the target business system by setting response time. First, log in to the dynamic defense system. Next, Fig. 20 As shown, enter the automatic handling-response strategy function, add a strategy, set a delayed response, and delay the response to the access of the specified source IP for 10S. Finally, as Fig.21 As shown, when the client to which the source IP belongs accesses the business system, the delayed response is successful and the interface response time is correct.

[0097] After analysis, the experimental results are in line with expectations. By setting a response strategy, we can successfully respond to non-blacklist traffic that accesses the business system and hits the source IP according to the strategy, and make a delayed response according to the set response time. By delaying the response, we can reduce the attacker's request speed, create an identification window for user behavior, and accurately and effectively resolve possible network attacks, thereby achieving the purpose of protecting the business system.

[0098] (6) Flow control module experiment

[0099] Configure the traffic control policy to limit the traffic forwarded to the target address of the response. First, log in to the dynamic defense system, enter the attack monitoring module, and view the rules displayed in each function interface, such as Fig. 22 As shown in the figure, the business end simulates a network attack on the business system, and the attack interception and alarm are correct. Next, enter the automatic disposal-flow control function and add a flow control strategy. Next, Fig.23 As shown, the traffic test script is executed on the client, data is sent to the business end, and the traffic restriction is successful.

[0100] After analysis, the experimental results are in line with expectations. By setting the flow control strategy, the normal traffic and specific traffic forwarded by the blacklist module can be rate-limited, the number of concurrent connections can be limited, and the bandwidth can be limited according to the flow control strategy. The restricted traffic will be correctly forwarded to the business system, which will not affect the correct access to the business system and can be flexibly configured.

[0101] Through 6 experiments, the effectiveness of the blacklist module was verified. The blacklist module can successfully add malicious IP addresses to the blacklist of network security devices, and implement access interception of malicious IPs, protect the network from known malicious sources, and verify the versatility of the traffic traction strategy. Honeypot diversion can divert specific attack traffic to the honeypot, thereby protecting the real business system from attack. The custom status code can return a custom status code to a specific traffic to mislead the attacker. Redirection can redirect the attack traffic to a custom page to prevent the attacker from accessing the real business system. By delaying the response to the attack traffic, the attack efficiency is reduced, and time is gained for defense measures. The practicality of the traffic control module is verified. The traffic control module can effectively limit the traffic forwarded to the target address, prevent network congestion caused by attacks, and ensure the normal operation of the business system. The flexibility and configurability of the system are verified. Each module in the experiment shows high flexibility and configurability, and the defense strategy can be quickly adjusted according to different security requirements. In summary, the experimental results prove the effectiveness and practicality of the automated dynamic security disposal method based on multi-technology fusion provided by the present invention in practical applications, and can provide strong protection for network security. Therefore, our invention is creative.

[0102] Example 3, reference Fig.24 , which is an embodiment of the present invention, provides an automated dynamic security handling system based on multi-technology integration, including a traffic collection module, a security policy module, and a policy execution module.

[0103] The traffic collection module is used to collect traffic data based on the security disposal unit, and perform preliminary analysis and extract key information to form data packets; the security policy module is used to build a security policy library, including blacklist policies, traffic traction policies, and traffic control policies; the policy execution module is used to select and execute security policies based on abnormal traffic characteristics.

[0104] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0105] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0106] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0107] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0108] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An automated dynamic security handling method based on multi-technology integration, characterized in that: include: Based on the safety disposal unit, flow data is collected; Build a security policy library; Select and execute security policies based on abnormal traffic characteristics.

2. The automated dynamic security handling method based on multi-technology integration as claimed in claim 1, characterized in that: The security handling unit includes a blacklist module, a traffic traction module, a traffic control module, an automatic orchestration module, a scheduling module, a traffic packet analysis module and an information extraction module.

3. The automated dynamic security handling method based on multi-technology integration as claimed in claim 2, characterized in that: The collection of traffic data includes the security handling unit collecting network traffic data through monitoring devices deployed in the network, and performing preliminary analysis and extracting key information to form data packets.

4. The automated dynamic security handling method based on multi-technology integration as claimed in claim 3 is characterized by: The construction of the security policy library includes a blacklist policy, a flow traction policy and a flow control policy.

5. The automated dynamic security handling method based on multi-technology integration as claimed in claim 4, characterized in that: The construction of the security policy library also includes blacklist policy using IP blocking; Traffic traction strategies include honeypot diversion, custom status code, redirection, and delayed response; Traffic control strategies include rate limiting, concurrent connection limit, and bandwidth control.

6. The automated dynamic security handling method based on multi-technology integration as claimed in claim 5, characterized in that: The selecting and executing of the security policy includes analyzing the attack traffic characteristics to select the security policy.

7. The automated dynamic security handling method based on multi-technology integration as claimed in claim 6, characterized in that: The selecting and executing of security policies also includes: If the source IP address of the attack traffic belongs to the blacklist, the blacklist policy is executed; If the attack traffic is not on the blacklist, the traffic diversion strategy is executed; If the attack traffic is normal business traffic, the traffic control policy is executed.

8. A system using the automated dynamic safety handling method based on multi-technology integration as claimed in any one of claims 1 to 7, characterized in that: Including traffic collection module, security policy module, and policy execution module; The flow collection module is used to collect flow data based on the security handling unit, and perform preliminary analysis and extract key information to form a data packet; The security policy module is used to build a security policy library, including blacklist policy, traffic traction policy and traffic control policy; The policy execution module is used to select and execute a security policy based on abnormal traffic characteristics.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the automated dynamic security disposal method based on multi-technology fusion described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the automated dynamic security disposal method based on multi-technology fusion described in any one of claims 1 to 7 are implemented.

Images