Active defense method and device based on network bypass, electronic equipment and storage medium

Abstract

The invention discloses an active defense method and device based on a network bypass, electronic equipment and a storage medium, and the method comprises the steps: obtaining the network mirror image flow of a protected system according to a pre-deployed network bypass; determining whether an access request of a visitor is an illegal access request or not through the network mirror image flow of the protected system; if it is determined that the access request of the visitor is an illegal access request, constructing a false access request by adopting a traffic spoofing strategy; and in response to the network response traffic of the false access request, returning the network response traffic to the visitor by adopting a traffic spoofing strategy so as to decoy an attacker to initiate an attack and actively discover an unknown attack behavior. Through the method and the device, possible unknown attack behaviors can be actively defended.

Description

Technical Field

[0001] The present application relates to the fields of network security and network intrusion detection technology, and in particular to an active defense method, device, electronic device, and storage medium based on network bypass. Background Art

[0002] With the rapid development of computer networks in various fields, various network attacks are emerging one after another. Traditional intrusion detection, firewalls, antivirus software, etc., only detect attack behaviors based on known rules or known prior knowledge, and are unable to effectively respond to unknown attacks.

[0003] Traditional network defense devices, deployed alongside existing systems, disrupt the overall system structure, impacting stability and resulting in poor availability. In some approaches, such as deploying firewalls in series at network egresses, a firewall failure can disrupt the entire network. Furthermore, traditional network defense devices are easily discovered by attackers, failing to decoy attackers and detect unknown attacks. For example, Web Application Firewalls (WAFs) or intrusion prevention systems can detect these network defense devices through network responses if an attacker attempts an attack. Summary of the Invention

[0004] The embodiments of the present application provide an active defense method, device, electronic device, and storage medium based on network bypass, which actively defend against unknown attack behaviors that may occur.

[0005] The embodiments of this application adopt the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides an active defense method based on network bypass, wherein the method includes:

[0007] Obtain the network mirror traffic of the protected system based on the pre-deployed network bypass;

[0008] Determining whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system;

[0009] If it is determined that the visitor's access request is an illegal access request, a traffic deception strategy is used to construct a false access request;

[0010] In response to the network response traffic of the false access request, a traffic deception strategy is adopted to return the network response traffic to the visitor, so as to trick the attacker into launching an attack and proactively discover unknown attack behaviors.

[0011] In some embodiments, the method of constructing a false access request using a traffic deception strategy further includes:

[0012] The illegal access request is introduced into the bait system by modifying the five-tuple in the mirror traffic request packet, wherein the five-tuple includes the source IP address, source port, destination IP address, destination port and transport layer protocol.

[0013] In some embodiments, the network response traffic in response to the false access request is returned to the visitor using a traffic deception strategy to proactively discover unknown attack behaviors, including:

[0014] Obtaining response traffic from the decoy system, modifying the five-tuple in the response packet, and returning the response packet to the visitor to trick the visitor into launching an attack;

[0015] The bait system is used to capture unknown attack behaviors among the attack behaviors initiated by the visitor.

[0016] In some embodiments, the proactive discovery of unknown attack behaviors includes:

[0017] Actively defend against the attacker and do not detect unknown attack behaviors based on known rules or known prior knowledge.

[0018] In some embodiments, obtaining the network mirror traffic of the protected system according to the pre-deployed network bypass includes:

[0019] Obtaining network traffic of the protected system according to a pre-deployed network bypass;

[0020] The network mirror traffic is generated according to the network traffic.

[0021] In some embodiments, determining whether the visitor's access request is an illegal access request by mirroring the network traffic of the protected system includes:

[0022] Determine whether the service accessed by the visitor is a service normally open to the public;

[0023] If it is determined that the visitor is not accessing a service that is normally open to the outside world, the visitor who initiated the access request is making an illegal access request, and the service is applicable to all services of the TCP / UDP protocol.

[0024] In some embodiments, it is used to discover known attack behaviors based on known rules or known prior knowledge, and / or to proactively discover unknown attack behaviors based on traffic deception strategies.

[0025] In a second aspect, an embodiment of the present application further provides an active defense device based on network bypass, wherein the device includes:

[0026] An acquisition module, used to acquire the network mirror traffic of the protected system based on a pre-deployed network bypass;

[0027] A determination module, configured to determine whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system;

[0028] A construction module, configured to construct a false access request by adopting a traffic deception strategy if it is determined that the visitor's access request is an illegal access request;

[0029] The response module is used to respond to the network response traffic of the false access request and return the network response traffic to the visitor by adopting a traffic deception strategy to trick the attacker into launching an attack and proactively discover unknown attack behaviors.

[0030] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory arranged to store computer-executable instructions, wherein the executable instructions, when executed, enable the processor to perform the above method.

[0031] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes the above method.

[0032] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: an active defense method based on network bypass, first, according to the pre-deployed network bypass, obtains the network mirror traffic of the protected system, and then determines whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system, and finally, if it is determined that the visitor's access request is an illegal access request, a traffic deception strategy is used to construct a false access request. And in response to the network response traffic of the false access request, a traffic deception strategy is used to return the network response traffic to the visitor to trick the attacker into launching an attack and actively discover unknown attack behaviors. Through this application, unknown attack behaviors can be actively discovered, and the bypass trapping is highly available and does not affect the stability of the existing system. Finally, the active defense method is highly concealed and difficult for attackers to discover. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0034] Figure 1 This is a flowchart of an active defense method based on network bypass in an embodiment of the present application;

[0035] Figure 2 This is a schematic diagram of the structure of an active defense device based on network bypass in an embodiment of the present application;

[0036] Figure 3 This is a structural diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0037] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0038] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0039] The present application embodiment provides an active defense method based on network bypass, such as Figure 1 As shown, a flowchart of an active defense method based on network bypass in an embodiment of the present application is provided, wherein the method includes at least the following steps S110 to S140:

[0040] Step S110, obtaining the network mirror traffic of the protected system according to the pre-deployed network bypass;

[0041] When active defense is required, deploying existing network defense equipment alongside existing systems disrupts the overall system structure and impacts system stability. Therefore, it is necessary to utilize pre-deployed network bypasses to obtain the network mirror traffic of the protected system.

[0042] It can be understood that the "protected system" here refers to a system that needs to perform network attack behavior detection, which is not specifically limited in the embodiments of this application. Of course, for intrusion detection, firewalls, anti-virus software, etc., attack behaviors can usually be discovered based on known rules or known prior knowledge.

[0043] The network mirrored traffic refers to bypass mirroring within network bypass. Bypass mirroring is a monitoring technology that copies network traffic from the normal network path and forwards it to a monitoring system via another network device. The basic principle of bypass mirroring is to insert a device that can copy network traffic into the network path and send the copied network traffic to the monitoring system for processing.

[0044] Bypass mirroring can monitor network traffic in real time and copy traffic on any network device. It can also copy traffic on the entire network device without being restricted by network devices or types of network devices. It can monitor traffic on any type of network device.

[0045] Step S120: determining whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system.

[0046] Based on the network mirror traffic of the protected system obtained in the above steps, it is further determined whether the current visitor's access request is an illegal access request or a legitimate access request. For legitimate access requests, no further processing is required. For illegal access requests, further measures must be taken to defraud the attacker.

[0047] Step S130: If it is determined that the visitor's access request is an illegal access request, a traffic deception strategy is used to construct a false access request.

[0048] If it is determined that the visitor's access request is an illegal access request, a traffic deception strategy is used to construct a false access request, which will be forwarded to the bait system, so that unknown attack behaviors can be captured through the bait system.

[0049] It should be noted that the "traffic spoofing strategy" can be to modify the five-tuple in the request packet or response packet to obtain a constructed false access request. The "traffic spoofing strategy" can also be other methods, which are not specifically limited in the embodiments of this application.

[0050] Step S140 , in response to the network response traffic of the false access request, a traffic deception strategy is adopted to return the network response traffic to the visitor, so as to trick the attacker into launching an attack and proactively discover unknown attack behaviors.

[0051] In the above steps, a bait system is constructed. This bait system will be accessed by visitors, so that unknown attack behaviors can be proactively discovered.

[0052] By adopting the above method, in response to the problem of various network attack incidents emerging in an endless stream, attackers can be proactively defended, thereby not discovering unknown attack behaviors based on known rules or known prior knowledge.

[0053] This approach addresses the issue of traditional network defense devices impacting the existing system structure and stability by adopting a network bypass deployment, which does not affect the overall system structure and achieves high availability. Furthermore, to address the vulnerability of traditional network defense devices to attackers, traffic spoofing technology is employed to conceal attackers and thus detect unknown attacks.

[0054] In one embodiment of the present application, the use of a traffic deception strategy to construct a false access request also includes: introducing the illegal access request into the bait system by modifying the five-tuple in the mirror traffic request packet, the five-tuple including the source IP address, source port, destination IP address, destination port and transport layer protocol.

[0055] For example, when accessing a website, only port 80 of the HTTP service is normally open to the public. At this point, if a visitor attempts to access the SSH service on port 22, this is an illegal access. By modifying the source address, destination address, and port number of the mirrored traffic request packet, the request traffic is redirected to the SSH service on port 22 of the decoy system.

[0056] In one embodiment of the present application, the network response traffic in response to the false access request uses a traffic deception strategy to return the network response traffic to the visitor to trick the attacker into launching an attack and actively discover unknown attack behaviors, including: obtaining the response traffic in the bait system, modifying the five-tuple in the response packet, and returning the response packet to the visitor to trick the visitor into launching an attack behavior; capturing unknown attack behaviors in the attack behaviors initiated by the visitor through the bait system.

[0057] For example, consider accessing a website. Normally, only port 80 of the HTTP service is open to the public. If a visitor attempts to access the SSH service on port 22, this is an illegal attempt. By modifying the mirrored traffic request packet's five-tuple information, including the source address, destination address, and port, the request traffic is redirected to the SSH service on port 22 of the decoy system. The decoy system's response traffic is then captured and the response packet's five-tuple information, including the source address, destination address, and port, is modified before being returned to the requester. This way, the requester appears to be able to access the protected system's SSH service on port 22, allowing them to launch an unknown attack. However, the actual unknown attack traffic is redirected to the decoy system, allowing them to capture unknown attack activity.

[0058] In one embodiment of the present application, the actively discovering unknown attack behaviors includes: actively defending against the attacker, and not detecting the unknown attack behaviors based on known rules or known prior knowledge.

[0059] By adopting the above method, it is possible to proactively defend against the attacker and detect unknown attack behaviors without relying on known rules or known prior knowledge.

[0060] In one embodiment of the present application, obtaining the network mirror traffic of the protected system based on a pre-deployed network bypass includes: obtaining the network traffic of the protected system based on the pre-deployed network bypass; and generating the network mirror traffic based on the network traffic.

[0061] Bypass mirroring can monitor network traffic in real time and copy traffic on any network device. It can also copy traffic on the entire network device without being restricted by network devices or types of network devices. It can monitor traffic on any type of network device.

[0062] Therefore, based on the pre-deployed network bypass, the network traffic of the protected system is captured, and then the network mirror traffic is generated based on the network traffic to implement the subsequent traffic deception strategy.

[0063] In one embodiment of the present application, the network mirror traffic of the protected system is used to determine whether the visitor's access request is an illegal access request, including: judging whether the service accessed by the visitor is a service normally open to the outside world; if it is judged that the service accessed by the visitor is not a service normally open to the outside world, then the visitor who initiates the access request is an illegal access request, and the service is applicable to all services of the TCP / UDP protocol.

[0064] If a visitor is detected accessing a service other than a normally open one, the request is considered illegal. Based on the visitor's illegal request, traffic spoofing techniques are used to construct a fake request, targeting a decoy system. For example, a website normally only provides HTTP service on port 80. If a visitor attempts to access the SSH service on port 22, this is considered illegal.

[0065] In one embodiment of the present application, it is used to discover known attack behaviors based on known rules or known prior knowledge, and / or to actively discover unknown attack behaviors based on traffic deception strategies.

[0066] The above method can proactively defend against attackers and proactively discover unknown attack behaviors based on traffic deception strategies. It can also proactively discover known attack behaviors based on known rules or known prior knowledge.

[0067] The embodiment of the present application also provides an active defense device 200 based on network bypass, such as Figure 2 As shown, a schematic diagram of the structure of an active defense device based on network bypass in an embodiment of the present application is provided. The active defense device based on network bypass 200 includes at least: an acquisition module 210, a determination module 220, a construction module 230 and a response module 240, wherein:

[0068] In one embodiment of the present application, the acquisition module 210 is specifically configured to: acquire network mirror traffic of the protected system according to a pre-deployed network bypass;

[0069] When active defense is required, deploying existing network defense equipment alongside existing systems disrupts the overall system structure and impacts system stability. Therefore, it is necessary to utilize pre-deployed network bypasses to obtain the network mirror traffic of the protected system.

[0070] It can be understood that the "protected system" here refers to a system that needs to perform network attack behavior detection, which is not specifically limited in the embodiments of this application. Of course, for intrusion detection, firewalls, anti-virus software, etc., attack behaviors can usually be discovered based on known rules or known prior knowledge.

[0071] The network mirrored traffic refers to bypass mirroring within network bypass. Bypass mirroring is a monitoring technology that copies network traffic from the normal network path and forwards it to a monitoring system via another network device. The basic principle of bypass mirroring is to insert a device that can copy network traffic into the network path and send the copied network traffic to the monitoring system for processing.

[0072] Bypass mirroring can monitor network traffic in real time and copy traffic on any network device. It can also copy traffic on the entire network device without being restricted by network devices or types of network devices. It can monitor traffic on any type of network device.

[0073] In one embodiment of the present application, the determination module 220 is specifically configured to determine whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system.

[0074] Based on the network mirror traffic of the protected system obtained in the above module, it is further determined whether the current visitor's access request is an illegal access request or a legitimate access request. For legitimate access requests, no further processing is required. For illegal access requests, further measures are required to defraud the attacker.

[0075] In one embodiment of the present application, the construction module 230 is specifically configured to: if it is determined that the visitor's access request is an illegal access request, construct a false access request using a traffic deception strategy.

[0076] If it is determined that the visitor's access request is an illegal access request, a traffic deception strategy will be used to construct a false access request. This false access request will be forwarded to the visitor of the illegal access request, thereby capturing unknown attack behaviors through the bait system.

[0077] It should be noted that the "traffic spoofing strategy" can be to modify the five-tuple in the request packet or response packet to obtain a constructed false access request. The "traffic spoofing strategy" can also be other methods, which are not specifically limited in the embodiments of this application.

[0078] In one embodiment of the present application, the response module 240 is specifically used to: respond to the network response traffic of the false access request, adopt a traffic deception strategy to return the network response traffic to the visitor, so as to trick the attacker into launching an attack and actively discover unknown attack behavior.

[0079] In the above steps, a bait system is constructed. This bait system will be accessed by visitors to trick attackers into launching attacks, thereby proactively discovering unknown attack behaviors.

[0080] It can be understood that the above-mentioned active defense device based on network bypass can implement the various steps of the active defense method based on network bypass provided in the aforementioned embodiment. The relevant explanations on the active defense method based on network bypass are applicable to the active defense device based on network bypass and will not be repeated here.

[0081] Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 3 At the hardware level, the electronic device includes a processor and, optionally, an internal bus, a network interface, and memory. The memory may include internal memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for its services.

[0082] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0083] The memory is used to store programs. Specifically, the program may include program code, which includes computer operating instructions. The memory may include internal memory and non-volatile memory, and provides instructions and data to the processor.

[0084] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming an active defense device based on network bypass at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

[0085] Obtain the network mirror traffic of the protected system based on the pre-deployed network bypass;

[0086] Determining whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system;

[0087] If it is determined that the visitor's access request is an illegal access request, a traffic deception strategy is used to construct a false access request;

[0088] In response to the network response traffic of the false access request, a traffic deception strategy is used to return the network response traffic to the visitor to trick the attacker into launching an attack and proactively discover unknown attack behaviors. Figure 1The method disclosed in the illustrated embodiment for executing a network bypass-based active defense device can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor or by software instructions. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0089] The electronic device may also perform Figure 1 Method for executing an active defense device based on network bypass in Figure 1 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0090] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, can enable the electronic device to execute Figure 1 The method performed by the active defense device based on network bypass in the illustrated embodiment is specifically used to perform:

[0091] Obtain the network mirror traffic of the protected system based on the pre-deployed network bypass;

[0092] Determining whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system;

[0093] If it is determined that the visitor's access request is an illegal access request, a traffic deception strategy is used to construct a false access request;

[0094] In response to the network response traffic of the false access request, a traffic deception strategy is used to return the network response traffic to the visitor to trick the attacker into launching an attack and actively discover unknown attack behaviors. It should be understood by those skilled in the art that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0099] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0100] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0102] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0103] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. An active defense method based on network bypass, wherein: The method comprises: Obtain the network mirror traffic of the protected system based on the pre-deployed network bypass; Determining whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system; If it is determined that the visitor's access request is an illegal access request, a traffic deception strategy is used to construct a false access request; In response to the network response traffic of the false access request, a traffic deception strategy is adopted to return the network response traffic to the visitor, so as to trick the attacker into launching an attack and actively discover unknown attack behaviors.

2. The method of claim 1, wherein: The method of using a traffic deception strategy to construct a false access request also includes: The illegal access request is introduced into the bait system by modifying the five-tuple in the mirror traffic request packet, wherein the five-tuple includes the source IP address, the source port, the destination IP address, the destination port and the transport layer protocol.

3. The method of claim 2, wherein: The network response traffic in response to the false access request uses a traffic deception strategy to return the network response traffic to the visitor, and actively discovers unknown attack behaviors, including: Acquire the response traffic in the bait system, and return the response packet to the visitor by modifying the five-tuple in the response packet, so as to trick the visitor into launching an attack behavior; The bait system is used to capture unknown attack behaviors among the attack behaviors initiated by the visitor.

4. The method of claim 2, wherein: The proactive discovery of unknown attack behaviors includes: Actively defend against the attacker, without detecting unknown attack behaviors based on known rules or known prior knowledge.

5. The method of claim 1, wherein: The obtaining of network mirror traffic of the protected system according to the pre-deployed network bypass includes: Obtain the network traffic of the protected system based on the pre-deployed network traffic mirroring device; The network traffic mirroring system generates the network mirror traffic according to the network traffic.

6. The method of claim 1, wherein: The determining whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system includes: Determine whether the service accessed by the visitor is normally open to the public; If it is determined that the visitor is not accessing a service that is normally open to the outside world, the visitor who initiated the access request is an illegal access request, and the service is applicable to all services of the TCP / UDP protocol.

7. The method of claim 1, wherein: Used to discover known attack behaviors based on known rules or known prior knowledge, and / or proactively discover unknown attack behaviors based on traffic deception strategies.

8. An active defense device based on network bypass, wherein: The device comprises: An acquisition module, used to acquire network mirror traffic of a protected system according to a pre-deployed network bypass; A determination module, used to determine whether the visitor's access request is an illegal access request through the network mirror traffic of the protected system; A construction module, used for constructing a false access request by adopting a traffic deception strategy if it is determined that the access request of the visitor is an illegal access request; The response module is used to respond to the network response traffic of the false access request, and adopt a traffic deception strategy to return the network response traffic to the visitor, so as to trick the attacker into launching an attack and actively discover unknown attack behaviors.

9. An electronic device, comprising: processor; as well as A memory arranged to store computer executable instructions, which when executed cause the processor to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of application programs, causes the electronic device to execute any one of the methods of claims 1 to 7.

Images