Network space anti-mapping method and device, electronic equipment and storage medium

Abstract

The invention provides a cyberspace anti-mapping method and device, electronic equipment and a storage medium, and relates to the technical field of cyberspace anti-mapping. The method comprises the following steps: detecting whether network traffic data of a mirror image port of a switch has a network space surveying and mapping behavior or not; wherein the switch mirror image port is a mirror image port of a switch connected with a plurality of terminals to be protected; after the target network flow data with the network space surveying and mapping behavior is detected, determining a target to-be-protected terminal pointed by the target network flow data; sending an anti-mapping instruction to the target to-be-protected terminal; wherein the anti-mapping instruction is used for indicating the target to-be-protected terminal to perform blocking processing or redirection processing on the target network flow data. According to the invention, the terminal can finely block or redirect the traffic data of the network space surveying and mapping behavior so as to protect the network assets of the terminal, and the problems that the network is delayed and the serial equipment does not support the calling of the linkage configuration interface can be avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace anti-mapping, and in particular to a cyberspace anti-mapping method, device, electronic equipment and storage medium. Background Art

[0002] Cyberspace mapping introduces new security risks and poses great challenges to cyberspace security governance. In order to cope with the security risks brought by cyberspace mapping, relevant cyberspace anti-mapping schemes have been proposed to prevent the mapping party from obtaining real and effective information and achieve the goal of protecting its own network assets.

[0003] However, the cyberspace anti-mapping solution in the related art relies on serial devices to implement traffic blocking and redirection. When the serial network device does not support linkage configuration interface calls, traffic blocking and redirection cannot be effectively implemented. Summary of the invention

[0004] The embodiments of the present invention provide a cyberspace anti-mapping method, device, electronic device and storage medium, which are used to solve the technical problem that the existing cyberspace anti-mapping method is not applicable to most serial devices.

[0005] In a first aspect, an embodiment of the present invention provides a network idle anti-mapping method, which is applied to an anti-mapping server, and the method includes: detecting whether the network traffic data of the switch mirror port has network space mapping behavior; wherein the switch mirror port is a mirror port of the switch connected to multiple terminals to be protected; after detecting the target network traffic data with network space mapping behavior, determining the target terminal to be protected to which the target network traffic data points; sending an anti-mapping instruction to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect the target network traffic data.

[0006] In some embodiments, determining the target terminal to be protected pointed to by the target network traffic data includes: determining the network address information pointed to by the target network traffic data; matching the network address information with the network address information of each of the multiple terminals to be protected, and taking the terminal to be protected whose network address information is successfully matched as the target terminal to be protected.

[0007] In some embodiments, sending the anti-mapping instruction to the target terminal to be protected includes: determining a target anti-mapping action corresponding to the target terminal to be protected, and generating the anti-mapping instruction based on the target anti-mapping action and identification information of the target network traffic data; and sending the anti-mapping instruction to the target terminal to be protected.

[0008] In some embodiments, the target anti-mapping action is redirection; the generating of the anti-mapping instruction based on the target anti-mapping action and the identification information of the target network traffic data includes: determining the target redirection service address information corresponding to the target terminal to be protected; generating the anti-mapping instruction based on the target anti-mapping action, the target redirection service address information and the identification information of the target network traffic data.

[0009] As a possible implementation method, the anti-mapping instruction is also used to instruct the target terminal to be protected to report the network parameter information of the target network traffic data; after sending the anti-mapping instruction to the target terminal to be protected, it also includes: receiving the network parameter information sent by each of the multiple terminals to be protected; and performing statistical analysis based on the network parameter information sent by each of the multiple terminals to be protected.

[0010] In some embodiments, before the detection of whether the network traffic data of the switch mirror port contains cyberspace mapping behavior, it also includes: based on the remote access interface, sending the agent program and the control instructions for running the agent program to the multiple terminals to be protected, so that the multiple terminals to be protected can establish a network channel with the anti-mapping server by running the agent program, and have the ability to execute the anti-mapping instructions.

[0011] In a second aspect, an embodiment of the present invention provides a cyberspace anti-mapping method, which is applied to a terminal to be protected, comprising: receiving an anti-mapping instruction sent by an anti-mapping server; wherein the anti-mapping instruction is sent by the anti-mapping server after detecting target network traffic data of the mirror port of the switch to which the terminal to be protected is connected; the target network traffic data is network traffic data pointing to the terminal to be protected and in which cyberspace mapping behavior exists; and blocking or redirecting the target network traffic data based on the anti-mapping instruction.

[0012] In some implementations, before receiving the anti-mapping instruction sent by the anti-mapping server, it also includes: receiving an agent program sent by the anti-mapping server based on a remote access interface and a control instruction to run the agent program; running the agent program based on the control instruction to establish a network channel with the anti-mapping server and have the ability to execute the anti-mapping instruction.

[0013] In a third aspect, an embodiment of the present invention provides a cyberspace anti-mapping device, which is applied to an anti-mapping server, comprising: a detection module, used to detect whether the network traffic data of the switch mirror port contains cyberspace mapping behavior; wherein the switch mirror port is a mirror port of the switch to which multiple terminals to be protected are connected; a determination module, used to determine the target terminal to be protected to which the target network traffic data points after detecting the target network traffic data containing cyberspace mapping behavior; a first sending module, used to send an anti-mapping instruction to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect the target network traffic data.

[0014] In a fourth aspect, an embodiment of the present invention provides a cyberspace anti-mapping device, which is applied to a terminal to be protected, and includes: a receiving module, which is used to receive an anti-mapping instruction sent by an anti-mapping server; wherein the anti-mapping instruction is sent by the anti-mapping server after detecting the target network traffic data of the mirror port of the switch to which the terminal to be protected is connected; the target network traffic data is network traffic data pointing to the terminal to be protected and in which there is cyberspace mapping behavior; a processing module, which is used to block or redirect the target network traffic data based on the anti-mapping instruction.

[0015] In a fifth aspect, an embodiment of the present invention provides an electronic device, comprising a processor and a memory storing a computer program, wherein the processor implements the above-mentioned cyberspace reverse mapping method when executing the program.

[0016] In a sixth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the above-mentioned cyberspace reverse mapping method is implemented.

[0017] In a seventh aspect, an embodiment of the present invention provides a computer program product, including a computer program, which implements the above-mentioned cyberspace reverse mapping method when executed by a processor.

[0018] The cyberspace anti-mapping method, device, electronic device and storage medium provided by the embodiment of the present invention, the anti-mapping service end detects whether the network traffic data of the switch mirror port contains cyberspace mapping behavior; wherein the switch mirror port is the mirror port of the switch connected to multiple terminals to be protected; after detecting the target network traffic data with cyberspace mapping behavior, the target terminal to be protected to which the target network traffic data points is determined; an anti-mapping instruction is sent to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect the target network traffic data. On the one hand, the present invention can realize the terminal to perform refined blocking or redirection of the traffic data of the cyberspace mapping behavior to protect the network assets of the terminal; on the other hand, since there is no need to connect the anti-mapping service end in series to the network channel, it will not cause network delay, and the operations such as traffic blocking or redirection are directly implemented by the terminal to be protected, and the participation of serial devices is also not required, avoiding the problem that the serial device does not support the linkage configuration interface call, thereby improving the applicability of the anti-mapping method. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 This is one of the schematic diagrams of the architecture of the cyberspace counter-mapping system in existing computing; Figure 2 This is the second schematic diagram of the architecture of the cyberspace counter-mapping system in existing computing; Figure 3 One of the flow diagrams of the cyberspace reverse mapping method provided by an embodiment of the present invention; Figure 4 A second flow chart of the cyberspace reverse mapping method provided by an embodiment of the present invention; Figure 5 A third flow chart of the cyberspace reverse mapping method provided by an embodiment of the present invention; Figure 6 A fourth flowchart of the cyberspace reverse mapping method provided by an embodiment of the present invention; Figure 7 Schematic diagram of the architecture of the cyberspace anti-mapping method according to an embodiment of the present invention; Figure 8 One of the structural schematic diagrams of the cyberspace anti-mapping device provided in an embodiment of the present invention; Fig. 9A second structural diagram of a cyberspace anti-mapping device provided by an embodiment of the present invention; Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] In recent years, cyberspace mapping has become a hot area of ​​cross-disciplinary integration such as network communication technology, cyberspace security, and geography. However, since all resources and services exposed on the Internet will be reflected in the cyberspace mapping platform, attackers can collect multi-dimensional information of the target through the mapping platform, explore the target's vulnerabilities, and further carry out specific attacks. Therefore, cyberspace mapping introduces new security risks and poses great challenges to cyberspace security governance. In order to cope with the security risks and asymmetric challenges brought by cyberspace mapping, some countries and important units have begun to adopt various asset detection and anti-detection technical means to prevent the mapping party from obtaining real and effective information through mapping technology, and thus fail to obtain a comprehensive and accurate cyberspace map, so as to achieve the goal of protecting and hiding their own networks and network assets.

[0023] At present, the deployment and operation mode of the anti-mapping system is usually to connect the anti-mapping system in series with the Internet entrance (such as Figure 1 Or deploy the anti-mapping system to run on the switch mirror port and link it with a third-party serial device (such as a firewall or router) (such as Figure 2 As shown). The anti-mapping system is connected in series in the network channel. The advantage is that after identifying the mapping behavior, it can quickly block the mapping behavior and provide resource interference function through traffic redirection function. The disadvantage is that it increases network delay. At the same time, there are system stability issues of the anti-mapping system itself, which affects the stability of the entire network. Serial deployment is usually not accepted in important business systems. The anti-mapping system is deployed on the mirror port of the switch and linked with a third-party serial device. The advantage is that after identifying the mapping behavior and linking with the serial device, traffic blocking or redirection can be achieved through the serial device. The disadvantage is that the mapping system needs to be adapted to the serial device interface, and most serial devices (such as firewalls and routers) do not provide this linkage configuration interface call, and cannot effectively block and redirect traffic.

[0024] In order to solve the above problems, embodiments of the present invention provide a cyberspace reverse mapping method, device, electronic device and storage medium.

[0025] Figure 3 This is one of the flowcharts of the cyberspace anti-mapping method provided by the embodiment of the present invention. It should be noted that the cyberspace anti-mapping method of the embodiment of the present invention is applied to the anti-mapping server. Figure 3 As shown, the method may include the following steps.

[0026] Step 301 , detecting whether network traffic data of a switch mirror port contains network space mapping behavior; wherein the switch mirror port is a mirror port of a switch to which multiple terminals to be protected are connected.

[0027] That is to say, the anti-mapping service end is connected to the mirror port of the switch to detect the network traffic data of the mirror port of the switch. Among them, multiple terminals to be protected can be terminals that need to be anti-mapping protected based on actual business needs. The switches connected to the multiple terminals to be protected can be one or more. If the multiple terminals to be protected are connected to the same switch, the anti-mapping service end is connected to the mirror port of the switch and detects the network traffic data of the mirror port; if the multiple terminals to be protected are connected to different switches, the anti-mapping service end is connected to the mirror ports of different switches.

[0028] Among them, the operating systems of the multiple terminals to be protected can be Linux, Windows, MacOS, etc.

[0029] In some embodiments, the implementation process of detecting whether the network traffic data of the switch mirror port contains network space mapping behavior may include: matching the real-time network traffic data of the switch mirror port with the traffic feature library based on a preset network space mapping behavior traffic feature library, and if the match is successful, determining that the network traffic data contains network space mapping behavior. The traffic feature library may include the IP address information and port number of the network space mapping party, and may also include the data packet interval timing characteristics of the traffic data containing network space measurement behavior, and may also include relevant characteristics of the data packet content, etc., all of which may be obtained by statistical analysis based on a large amount of traffic data of network idle mapping behavior.

[0030] In other embodiments, detection can also be performed based on a trained cyberspace mapping recognition model, where real-time network traffic data of the switch mirror port is input into the cyberspace mapping recognition model, and based on the recognition result output by the model, it is determined whether the network traffic data has cyberspace mapping behavior. The cyberspace mapping recognition model can be a neural network model, which is trained based on training samples composed of historical network traffic data and their corresponding label values ​​indicating whether there is cyberspace mapping behavior.

[0031] Step 302, after detecting the target network traffic data with cyberspace mapping behavior, determine the target terminal to be protected pointed to by the target network traffic data.

[0032] That is to say, if a network traffic data is detected to have a network space mapping behavior, the target network traffic data is determined by the network traffic data. It should be noted that the target network traffic data may include only one data packet, or may include multiple continuous and identically directed data packets, that is, the target network traffic data is continuous data pointing to the same network address information.

[0033] In some embodiments, the target terminal to be protected pointed to by the target network traffic data refers to the terminal to be protected that receives the target network traffic data. It is understandable that the terminal pointed to by the target network traffic data that may have cyberspace mapping behavior is not among the multiple terminals to be protected. In this case, there is no need to perform subsequent steps, that is, the target network traffic data is not subjected to reverse mapping processing. If the terminal pointed to by the target network traffic data that has cyberspace mapping behavior is among the multiple terminals to be protected, the terminal it points to is determined as the target terminal to be protected.

[0034] As a possible implementation method, the process of determining the target protected terminal pointed to by the target network traffic data may include: determining the target network address information pointed to by the target network traffic data; matching the target network address information with the network address information of each of multiple terminals to be protected, and taking the terminal to be protected whose network address information is successfully matched as the target protected terminal.

[0035] The network address information may include IP address information and port number. As an example, the five-tuple information of the target network traffic data may be determined first, and based on the five-tuple information, the destination IP address information and destination port number of the target network traffic data may be determined; the destination IP address information and destination port number may be matched with the IP address information and port number of each of the multiple terminals to be protected; if the IP address information of a terminal to be protected is consistent with the destination IP address information, and the port number is consistent with the destination port number, then the network address information of the terminal to be protected is successfully matched, and the terminal to be protected is determined as the target terminal to be protected.

[0036] Step 303: Send an anti-mapping instruction to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect target network traffic data.

[0037] That is, after detecting the target network traffic data directed to the target terminal to be protected, an anti-mapping instruction is sent to the target terminal to be protected, so that the target terminal to be protected performs blocking processing or redirection processing on the target network traffic data.

[0038] In some embodiments, the anti-mapping instruction may include an anti-mapping action and may also include identification information of the target network traffic data, so that after receiving the anti-mapping instruction, the target terminal to be protected can intercept the corresponding target data packet at the operating system kernel layer based on the identification information of the target network traffic data in the anti-mapping instruction, and process the target data packet according to the anti-mapping action. Among them, the anti-mapping action can be a blocking process, and may also include a redirection process. If the anti-mapping action is a blocking process, the target terminal to be protected can discard the target data packet and not respond to the mapping behavior data. If the anti-mapping action is a blocking process, the target terminal to be protected can redirect the target data packet to other false services to feedback false network resource data to the mapping party, thereby protecting the network resources of the target terminal to be protected.

[0039] In some embodiments of the present invention, multiple terminals to be protected have a network channel with the anti-mapping server and also have the ability to execute anti-mapping instructions. As an example, an anti-mapping client can be installed in each of the multiple terminals to be protected, a network channel is established between the anti-mapping client and the anti-mapping server, and anti-mapping instructions are received and executed based on the anti-mapping client.

[0040] That is to say, the cyberspace anti-mapping method of the present invention does not require a linkage configuration interface for serial devices, and does not rely on serial devices to implement traffic blocking or redirection processing. Instead, the terminal directly blocks or redirects network traffic data with mapping behavior, so that it can be applied to respective network environments, does not require changes to the network topology, does not affect network performance, and can also accurately detect and handle network mapping behavior in real time.

[0041] According to the cyberspace anti-mapping method of the embodiment of the present invention, the anti-mapping service end detects whether the network traffic data of the switch mirror port contains cyberspace mapping behavior; wherein the switch mirror port is the mirror port of the switch connected to multiple terminals to be protected; after detecting the target network traffic data with cyberspace mapping behavior, the target terminal to be protected to which the target network traffic data points is determined; an anti-mapping instruction is sent to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect the target network traffic data. On the one hand, the present invention can realize the terminal to perform refined blocking or redirection of the traffic data of cyberspace mapping behavior to protect the network assets of the terminal; on the other hand, since there is no need to connect the anti-mapping service end in series to the network channel, it will not cause network delays, and the operations such as traffic blocking or redirection are directly implemented by the terminal to be protected, without the participation of serial devices, avoiding the problem that the serial device does not support the linkage configuration interface call, thereby improving the applicability of the anti-mapping method.

[0042] Figure 4 The second flowchart of the cyberspace reverse mapping method provided by the embodiment of the present invention is as follows. Figure 4 As shown, the process of sending an anti-mapping instruction to the target terminal to be protected may include the following steps.

[0043] Step 401: determine the target anti-mapping action corresponding to the target terminal to be protected, and generate an anti-mapping instruction based on the target anti-mapping action and identification information of the target network traffic data.

[0044] In some embodiments, the correspondence between the terminal to be protected and the anti-mapping action can be pre-configured, and the anti-mapping action can be blocking or redirecting. For example, the correspondence between the terminal to be protected and the anti-mapping action can be pre-configured based on user requirements corresponding to different terminals to be protected. When executing step 401, based on the configured correspondence, a target anti-mapping action corresponding to the target terminal to be protected is obtained.

[0045] Among them, the identification information of the target network traffic data refers to information that can distinguish the target network traffic data, such as the five-tuple information of the target network traffic data, where the five-tuple information may include the source IP address information, source port number, destination IP address information, destination port number and transmission protocol of the target network traffic data.

[0046] In some embodiments, based on the identification information of the target anti-mapping action and the target network traffic data, the content of the generated anti-mapping instruction may include the identification information of the target anti-mapping action and the identification information of the target network traffic data. For example, the anti-mapping instruction may be {identification information of the blocking action, five-tuple information of the target network traffic data}.

[0047] In some embodiments, the redirection process may be to redirect the target network traffic data to other false services, and the false services return response data and fingerprint information, etc., to interfere with the surveying and mapping party, so the target terminal to be protected needs the redirection service address information when performing the redirection process, and the redirection service address information may be the default address information, or may be determined from a plurality of preset false container services. The redirection service address information may include the IP address information and port number of the redirection service.

[0048] As a possible approach, if the target anti-mapping action is redirection, the target terminal to be protected can redirect the target network traffic data to the default service.

[0049] As another possible implementation method, if the target anti-mapping action is redirection, the implementation process of generating an anti-mapping instruction based on the target anti-mapping action and the identification information of the target network traffic data may include: determining the target redirection service address information corresponding to the target terminal to be protected; generating an anti-mapping instruction based on the target anti-mapping action, the target redirection service address information and the identification information of the target network traffic data.

[0050] For example, the content of the anti-mapping instruction may include five-tuple information of redirection action, target redirection service address information and target network traffic data.

[0051] Among them, the process of determining the target redirection service address information corresponding to the target terminal to be protected can be to determine the default redirection service address information as the target redirection service address information, or to determine the target redirection service address information corresponding to the target terminal to be protected based on the correspondence between the preset terminal to be protected and the redirection service address information, or to determine the target redirection service address information from multiple preset redirection service address information based on other rules.

[0052] In some embodiments, when the anti-mapping service is initialized, it will start multiple false containers and services, and map the multiple false containers and services to the local area network address range of the terminal to be protected, and the redirection service address information is the address information of the multiple false containers and services that have been started. In other embodiments, the multiple false containers and services can also be started on other servers, and these services are all pre-set.

[0053] Step 402: Send the anti-mapping instruction to the target terminal to be protected.

[0054] According to the network space anti-mapping method of the embodiment of the present invention, by determining the target anti-mapping action corresponding to the target terminal to be protected, and based on the identification information of the target anti-mapping action and the target network traffic data, an anti-mapping instruction is generated; the anti-mapping instruction is sent to the target terminal to be protected, which can support flexible configuration of the anti-mapping action of the terminal to be protected, and further enhance the flexibility of network idle anti-mapping.

[0055] In some embodiments, in order to facilitate statistics on the data of cyberspace mapping behavior, the reverse mapping instruction is also used to instruct the target terminal to be protected to report the network parameter information of the target network traffic data, that is, to send the network parameter information of the target network traffic data to the reverse mapping server. The reverse mapping instruction can instruct the target terminal to be protected to report according to the default reporting period, and can also report according to the specified reporting period. Among them, the network parameter information of the target network traffic data may include the five-tuple information of the target network traffic data, the timestamp of the target network traffic data, the network load, the frequency and other information.

[0056] As a possible implementation manner, the anti-mapping instruction generated by the anti-mapping server may further include a target reporting period, which may be a default one or may be determined based on a correspondence between a pre-configured reporting period and the terminal to be protected.

[0057] As another possible implementation, the anti-mapping instruction generated by the anti-mapping server may include not only the target reporting period but also the target reporting network parameters, that is, the target terminal to be protected may report the network parameter information of the target network traffic data based on the target reporting parameters in the anti-mapping instruction. The target reporting network parameters may be default or determined based on the correspondence between the pre-configured reporting network parameters and the terminal to be protected.

[0058] In the above scenario, if Figure 5 As shown, the cyberspace anti-mapping method of an embodiment of the present invention further includes the following steps after sending an anti-mapping instruction to the target terminal to be protected.

[0059] Step 501: receiving network parameter information respectively sent by a plurality of terminals to be protected.

[0060] Step 502: Perform statistical analysis based on network parameter information sent by multiple terminals to be protected.

[0061] In some embodiments, the anti-mapping service end may perform statistical analysis based on the network parameter information sent by each of the multiple terminals to be protected to analyze the relevant characteristic information of the cyberspace mapping behavior, and apply it to the detection of the cyberspace mapping behavior, thereby improving the accuracy of the detection of the cyberspace mapping behavior and further protecting the security of the network resource information of each terminal.

[0062] In some embodiments, in order to avoid updating the protected terminal, before detecting whether the network traffic data of the switch mirror port contains cyberspace mapping behavior, it also includes: based on the remote access interface, sending the agent program and the control instructions for running the agent program to multiple protected terminals, so that the multiple protected terminals can establish a network channel with the anti-mapping server by running the agent program, and have the ability to execute anti-mapping instructions.

[0063] That is to say, the anti-mapping server can execute the proxy program on multiple terminals to be protected through the remote access interface, so that a network channel can be established with the anti-mapping server without the terminal being aware of it, and it has the ability to point to anti-mapping instructions, thereby avoiding modification and updating on the terminal side and not affecting the normal use of the terminal. Among them, the remote access interface can be an SSH interface, an RDP interface, etc.

[0064] Next, the implementation process of the cyberspace anti-mapping method on the terminal side to be protected will be introduced.

[0065] Figure 6 The fourth flowchart of the network space anti-mapping method provided by the embodiment of the present invention. It should be noted that the network space anti-mapping method of the embodiment of the present invention is applied to the terminal to be protected. Figure 6 As shown, the method may include the following steps.

[0066] Step 601, receiving an anti-mapping instruction sent by an anti-mapping server; wherein the anti-mapping instruction is sent by the anti-mapping server after detecting the target network traffic data of the mirror port of the switch to which the terminal to be protected is connected; the target network traffic data is the network traffic data pointing to the terminal to be protected and having network space mapping behavior.

[0067] Step 602: blocking or redirecting the target network traffic data based on the anti-mapping instruction.

[0068] In some embodiments, the identification information of the target network traffic data and the target anti-mapping action (blocking or redirection) can be determined based on the anti-mapping instruction. Based on the identification information of the target network traffic data, the network traffic data entering the terminal is screened, and the data packets corresponding to the target network traffic data are intercepted at the kernel layer of the operating system, and these data packets are blocked or redirected according to the target anti-mapping action. For example, if the target anti-mapping action is blocking, the data packets corresponding to the target network traffic data are directly discarded at the kernel level, and no response is made to the mapping behavior; if the target anti-mapping action is redirection, the data packets corresponding to the target network traffic data are forwarded to the specified container and service, so that the specified container and service return the response data and fingerprint information to the mapping party, thereby covering up and protecting the terminal operating system, service and application information, and achieving the purpose of interference.

[0069] In other embodiments, if the target anti-mapping action contained in the anti-mapping instruction is redirection, the target redirection service address information can also be determined based on the anti-mapping instruction, and the target network traffic data can be forwarded to the target redirection service address information.

[0070] In some other embodiments, the network parameter information of the target network traffic data can also be sent to the reverse mapping server based on the reverse mapping instruction. For example, the target reporting period can be determined based on the reverse mapping instruction, and each time the target network traffic data is processed, the network parameter information of the processed target network traffic data is logged, and the network parameter information in the stored log record is sent to the reverse mapping server according to the target reporting period; the target reporting period and the target reporting network parameter can also be determined based on the reverse mapping instruction, and each time the target network traffic data is processed, the network parameter information of the target network traffic data is logged according to the target reporting network parameter, and the network parameter information in the stored log record is sent to the reverse mapping server according to the target reporting period.

[0071] In some embodiments, in order to enable the terminal to be protected to have the ability to point to the above-mentioned cyberspace anti-mapping method, before receiving the anti-mapping instructions sent by the anti-mapping server, it also includes: receiving the agent program and control instructions for running the agent program sent by the anti-mapping server based on the remote access interface; running the agent program based on the control instructions to establish a network channel with the anti-mapping server, and having the ability to execute the anti-mapping instructions.

[0072] According to the cyberspace anti-mapping method of the embodiment of the present invention, the terminal to be protected receives the anti-mapping instruction sent by the anti-mapping service end; wherein the anti-mapping instruction is sent by the anti-mapping service end after detecting the target network traffic data of the mirror port of the switch to which the terminal to be protected is connected; the target network traffic data is the network traffic data pointing to the terminal to be protected and having cyberspace mapping behavior; and the target network traffic data is blocked or redirected based on the anti-mapping instruction. On the one hand, the present invention can realize the refined blocking or redirection of the traffic data of the cyberspace mapping behavior by the terminal to protect the network assets of the terminal. On the other hand, since there is no need to connect the anti-mapping service end in series to the network channel, it will not cause network delays, and the operations such as traffic blocking or redirection are directly implemented by the terminal to be protected, and the participation of serial devices is also not required, thereby avoiding the problem that the serial device does not support the call of the linkage configuration interface, thereby improving the applicability of the anti-mapping method.

[0073] Figure 7 FIG. 1 is a schematic diagram of the architecture of the cyberspace reverse mapping method according to an embodiment of the present invention. Figure 7 As shown, the anti-mapping server is connected to the switch mirror port, and multiple terminals to be protected have established network channels with the anti-mapping server. When the anti-mapping system is initialized, it starts multiple fake container services and maps the services to the LAN address range of multiple terminals to be protected.

[0074] The following is a description of a cyberspace anti-mapping device provided in an embodiment of the present invention. The cyberspace anti-mapping device described below and the cyberspace anti-mapping method described above can refer to each other.

[0075] Figure 8 This is one of the structural diagrams of the cyberspace anti-mapping device provided in the embodiment of the present invention. It should be noted that the cyberspace anti-mapping device in the embodiment of the present invention is applied to the anti-mapping server. Figure 8 As shown, the device includes: a detection module 810, a determination module 820, and a first sending module 830.

[0076] A detection module 810 is used to detect whether the network traffic data of the switch mirror port contains network space mapping behavior; wherein the switch mirror port is a mirror port of the switch to which the multiple terminals to be protected are connected; A determination module 820 is used to determine the target terminal to be protected pointed to by the target network traffic data after detecting the target network traffic data with the network space mapping behavior; The first sending module 830 is used to send an anti-mapping instruction to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect the target network traffic data.

[0077] In some embodiments, the determination module 820 is specifically used to: determine the target network address information pointed to by the target network traffic data; match the target network address information with the network address information of each of the multiple terminals to be protected, and use the terminal to be protected whose network address information is successfully matched as the target terminal to be protected.

[0078] In some embodiments, the first sending module 830 is specifically used to: determine the target anti-mapping action corresponding to the target terminal to be protected, and generate the anti-mapping instruction based on the target anti-mapping action and the identification information of the target network traffic data; and send the anti-mapping instruction to the target terminal to be protected.

[0079] In some embodiments, the target anti-mapping action is redirection; the first sending module 830 is also used to: determine the target redirection service address information corresponding to the target terminal to be protected; based on the target anti-mapping action, the target redirection service address information and the identification information of the target network traffic data, generate the anti-mapping instruction.

[0080] In some embodiments, the anti-mapping instruction is also used to instruct the target terminal to be protected to report the network parameter information of the target network traffic data; the device also includes a statistical module 840, and the statistical module 840 is used to: after sending the anti-mapping instruction to the target terminal to be protected, receive the network parameter information sent by each of the multiple terminals to be protected; and perform statistical analysis based on the network parameter information sent by each of the multiple terminals to be protected.

[0081] In the first embodiment, the device also includes a second sending module 850, which is used to send an agent program and a control instruction for running the agent program to the multiple terminals to be protected based on a remote access interface before detecting whether the network traffic data of the switch mirror port contains network space mapping behavior, so that the multiple terminals to be protected can establish a network channel with the anti-mapping server by running the agent program and have the ability to execute the anti-mapping instruction.

[0082] Fig. 9 The second structural diagram of the network space anti-mapping device provided by the embodiment of the present invention. It should be noted that the network space anti-mapping device of the embodiment of the present invention can be applied to the terminal to be protected. Fig. 9As shown, the device includes: a receiving module 910 and a processing module 920. The receiving module 910 is used to receive an anti-mapping instruction sent by an anti-mapping service end; wherein the anti-mapping instruction is sent by the anti-mapping service end after detecting the target network traffic data of the mirror port of the switch to which the terminal to be protected is connected; the target network traffic data is the network traffic data pointing to the terminal to be protected and having network space mapping behavior; the processing module 920 is used to block or redirect the target network traffic data based on the anti-mapping instruction.

[0083] In some embodiments, the device also includes an operation module 930, which is used to receive an agent program sent by the anti-mapping server based on a remote access interface and a control instruction to run the agent program before receiving the anti-mapping instruction sent by the anti-mapping server; run the agent program based on the control instruction to establish a network channel with the anti-mapping server, and have the ability to execute the anti-mapping instruction.

[0084] Fig.10 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.10 As shown, the electronic device may include: a processor 1010, a communication interface 1020, a memory 1030 and a communication bus 1040, wherein the processor 1010, the communication interface 1020 and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 may call the computer program in the memory 1030 to execute the steps of the cyberspace reverse mapping method provided in the above embodiments.

[0085] In addition, the logic instructions in the above-mentioned memory 1030 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0086] On the other hand, an embodiment of the present invention further provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the steps of the cyberspace reverse mapping method provided in the above embodiments.

[0087] On the other hand, an embodiment of the present invention further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, and the computer program is used to enable a processor to execute the cyberspace reverse mapping method provided in the above embodiments.

[0088] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0089] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0090] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cyberspace reverse mapping method, characterized in that: Applied to the reverse mapping server, the method includes: Detect whether there is network space mapping behavior in the network traffic data of the switch mirror port; wherein the switch mirror port is the mirror port of the switch connected to multiple terminals to be protected; After detecting the target network traffic data with cyberspace mapping behavior, determining the target terminal to be protected pointed to by the target network traffic data; Sending an anti-mapping instruction to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect the target network traffic data.

2. The method according to claim 1, characterized in that The determining the target terminal to be protected pointed to by the target network traffic data includes: Determine the target network address information pointed to by the target network traffic data; The target network address information is matched with the network address information of each of the multiple terminals to be protected, and the terminal to be protected whose network address information is successfully matched is used as the target terminal to be protected.

3. The method according to claim 1, characterized in that The sending of the anti-mapping instruction to the target terminal to be protected includes: Determine a target anti-mapping action corresponding to the target terminal to be protected, and generate the anti-mapping instruction based on the target anti-mapping action and identification information of the target network traffic data; The anti-mapping instruction is sent to the target terminal to be protected.

4. The method according to claim 3, characterized in that: The target anti-mapping action is redirection; The generating the anti-mapping instruction based on the target anti-mapping action and the identification information of the target network traffic data includes: Determine the target redirection service address information corresponding to the target terminal to be protected; The anti-mapping instruction is generated based on the target anti-mapping action, the target redirection service address information and the identification information of the target network traffic data.

5. The method according to claim 3, characterized in that: The anti-mapping instruction is also used to instruct the target terminal to be protected to report the network parameter information of the target network traffic data; After sending the anti-mapping instruction to the target terminal to be protected, the method further includes: Receiving network parameter information sent by each of the plurality of terminals to be protected; Statistical analysis is performed based on the network parameter information respectively sent by the multiple terminals to be protected.

6. The method according to any one of claims 1 to 5, characterized in that Before detecting whether the network traffic data of the switch mirror port has network space mapping behavior, the method further includes: Based on the remote access interface, the agent program and the control instructions for running the agent program are sent to the multiple terminals to be protected, so that the multiple terminals to be protected can establish a network channel with the anti-mapping server by running the agent program and have the ability to execute the anti-mapping instructions.

7. A cyberspace reverse mapping method, characterized in that: Applied to terminals to be protected, including: Receiving an anti-mapping instruction sent by an anti-mapping service end; wherein the anti-mapping instruction is sent by the anti-mapping service end after detecting target network traffic data of the mirror port of the switch to which the terminal to be protected is connected; the target network traffic data is network traffic data pointing to the terminal to be protected and having network space mapping behavior; The target network traffic data is blocked or redirected based on the anti-mapping instruction.

8. The method according to claim 7, characterized in that Before receiving the reverse mapping instruction sent by the reverse mapping service end, the method further includes: Receiving an agent program and a control instruction for running the agent program sent by the anti-mapping service end based on a remote access interface; The agent program is run based on the control instruction to establish a network channel with the reverse mapping server and has the ability to execute the reverse mapping instruction.

9. A cyberspace anti-mapping device, characterized in that: Applied to the anti-mapping server, including: A detection module, used to detect whether the network traffic data of the switch mirror port contains network space mapping behavior; wherein the switch mirror port is a mirror port of the switch to which the multiple terminals to be protected are connected; A determination module, configured to determine, after detecting target network traffic data with cyberspace mapping behavior, a target terminal to be protected pointed to by the target network traffic data; The first sending module is used to send an anti-mapping instruction to the target terminal to be protected; wherein the anti-mapping instruction is used to instruct the target terminal to be protected to block or redirect the target network traffic data.

10. A cyberspace anti-mapping device, characterized in that: Applied to terminals to be protected, including: A receiving module, used for receiving an anti-mapping instruction sent by an anti-mapping service end; wherein the anti-mapping instruction is sent by the anti-mapping service end after detecting target network traffic data of the mirror port of the switch to which the terminal to be protected is connected; the target network traffic data is network traffic data pointing to the terminal to be protected and having network space mapping behavior; A processing module is used to block or redirect the target network traffic data based on the anti-mapping instruction.

11. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the cyberspace reverse mapping method described in any one of claims 1 to 8 is implemented.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the cyberspace reverse mapping method described in any one of claims 1 to 8 is implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the cyberspace reverse mapping method described in any one of claims 1 to 8 is implemented.

Images