Equipment protection method and computer readable storage medium

Abstract

The invention relates to the technical field of network security, in particular to an equipment protection method, which is applied to a management and control server, and comprises the following steps of: issuing an experiment message to simulation equipment to carry out payload byte group lifting simulation verification, and continuously receiving a simulation response result of the experiment message; when the simulation negative response of the received experiment message accumulatively reaches a set number of times, giving an alarm, and marking the experiment message as a defense message; and sending the defense message to gateway equipment, so that the gateway equipment does not respond when receiving the message the same as the defense message again. According to the invention, the simulation equipment finds the message harmful to the gateway equipment in advance as the defense message, the defense message is sent to the gateway equipment, and the gateway equipment does not respond when receiving the message matched with the payload of the defense message again, so that the robustness of the equipment is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a device protection method and a computer-readable storage medium. Background Art

[0002] When current network devices process abnormal messages, defects inherent in the device's functionality can cause them to restart, impacting live network services. If the device receives the same type of message again, it will restart again. This issue cannot be resolved unless a patch is installed or the device is upgraded. Therefore, improving the device's ability to defend against abnormal messages is a technical problem that those skilled in the art need to address. Summary of the Invention

[0003] The present invention provides a device protection method and a computer-readable storage medium, which are intended to find abnormal messages harmful to the device through simulation testing and improve the robustness of the device by actively defending against them.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] In a first aspect, a device protection method applied to a management and control server is provided, comprising:

[0006] Sending the experimental message to the simulation device for payload byte group enumeration simulation verification, and continuously receiving the simulation response result of the experimental message;

[0007] When the number of simulated negative responses received to the experimental message reaches a set number, an alarm is issued and the experimental message is marked as a defense message;

[0008] The defense message is sent to a gateway device, so that the gateway device does not respond when it receives a message identical to the defense message again.

[0009] Furthermore, the step of sending the experimental message to the simulation device for payload byte group enumeration simulation verification and continuously receiving the simulation response result of the experimental message includes:

[0010] Step 1: Generate various types of experimental messages based on the message generation model;

[0011] Step 2: Send any known type of experimental message to the simulation device and receive the simulation response result fed back by the simulation device;

[0012] Step 3: Adjust the payload of the current experimental message and send it back to the simulation device, and receive the simulation response result fed back by the simulation device again;

[0013] Step 4: Repeat step 3 until the payload byte group enumeration simulation verification of the current experimental message is completed, and record the number of simulated negative responses of the current experimental message.

[0014] Furthermore, when the simulation program of the simulation device can process the experimental message normally, the control server receives a positive simulation response fed back by the simulation device;

[0015] When the simulation program of the simulation device processes the experimental message abnormally, the management and control server receives a simulation negative response fed back by the simulation device.

[0016] Furthermore, the adjusting the payload portion of the current experimental message includes:

[0017] Adjust the payload length of the experimental message;

[0018] Alternatively, the payload content of a message with a specified length is adjusted.

[0019] Furthermore, before generating experimental messages of various message types based on the message generation model, the following steps are included:

[0020] Collect data packets supported by the gateway device, including standard protocol packets and private protocol packets;

[0021] Extract message features from the collected data messages, including message type, message sequence number, message length, message version number, and timestamp, and construct a feature vector set after preprocessing the message features;

[0022] The feature vector set is used to train the generator and discriminator based on the generative adversarial network (GAN) model respectively to obtain a message generation model and a message recognition model.

[0023] Furthermore, the method further comprises:

[0024] The management and control server receives the real message type of the experimental message fed back by the simulation device, and adjusts the parameters of the message recognition model according to the real message type of the experimental message.

[0025] In a second aspect, a device protection method applied to a gateway device is provided, comprising:

[0026] After receiving the defense message, extracting the payload portion of the defense message as the harmful payload according to the message type of the defense message;

[0027] When a service message of the same type as the defense message is received again, if the payload portion of the service message successfully matches the harmful payload, the service message is not responded to; otherwise, the service message is processed normally.

[0028] Furthermore, extracting the payload portion of the defense message as the harmful payload according to the message type of the defense message includes:

[0029] Identifying a message format of the defense message according to its message type;

[0030] extracting a payload portion as a harmful payload according to a message format of the defense message, including a payload length and payload content;

[0031] The message type and harmful payload of the defense message are saved in memory and disk files.

[0032] Furthermore, when a service message of the same type as the defense message is received again, the payload portion of the service message is compared with the harmful payload in full bytes, and if the two are exactly the same, the match is successful.

[0033] Based on the same inventive concept, a computer storage medium is also provided, in which computer executable instructions are stored. When the computer executable instructions are executed, the aforementioned device protection method is implemented.

[0034] Technical effects and advantages of the present invention:

[0035] (1) The message generation model generates various types of experimental messages for device testing by learning the standard protocol messages and private protocol messages supported by actual gateway devices;

[0036] (2) Using the simulation device to perform payload byte group simulation verification on the experimental message, the control server determines that the experimental message with a cumulative simulated negative response reaching a set number of times is harmful to the actual gateway device and marks it as a defense message;

[0037] (3) The defense message is sent to the gateway device. When the gateway device receives the same message as the defense message again, it does not respond, so that the gateway device can actively defend against the defense message, thereby improving the robustness of the device.

[0038] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 A schematic diagram of a flow chart of a device protection method provided in a first embodiment of the present invention;

[0041] Figure 2 A schematic flow chart of a device protection method provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0043] In order to improve the active protection capability of the device, the first embodiment of the present invention provides a device protection method, which is applied to the management and control server, such as Figure 1 As shown, the method includes the following steps:

[0044] S1. Send the experimental message to the simulation device for payload byte group enumeration simulation verification, and continuously receive the simulation response result of the experimental message;

[0045] S2. When the cumulative number of simulated negative responses received to the experimental message reaches a set number, an alarm is issued and the experimental message is marked as a defense message;

[0046] S3. Send the defense message to a gateway device, so that the gateway device does not respond when it receives a message identical to the defense message again.

[0047] The control server sends the experimental message to the simulation device, and uses the simulation program to pre-process the experimental message. If the simulation program can process the experimental message normally, the simulation device will feedback a simulation positive response to the control server. If the simulation program processes the experimental message abnormally, the simulation device will feedback a simulation negative response to the control server.

[0048] In an embodiment of the present invention, a simulation device is used to perform payload byte group enumeration simulation verification on an experimental message. During the payload byte group enumeration simulation verification process of the experimental message, when the number of simulated negative responses received by the control server reaches a set number, it indicates that the experimental message may be harmful to the actual gateway device. The control server reports an alarm and marks the experimental message as a defense message. In an embodiment of the present invention, a control server and a simulation device are used to perform simulation tests on the experimental message, and harmful messages that may cause abnormal operation of the actual gateway device are found in advance. The harmful messages are sent to the gateway device as defense messages. When the gateway device receives the same message as the defense message again, it does not respond, so that the gateway device can actively defend against harmful messages, thereby improving the robustness of the device.

[0049] According to an embodiment of the present invention, the management and control server generates experimental messages according to the message protocol format, or collects data messages in the existing network from network devices (such as switches, routers, etc.), and then generates a set of message generation models that can generate various types of messages through offline learning.

[0050] The above step S1 specifically includes:

[0051] Step 1: Generate various types of experimental messages based on the message generation model;

[0052] Step 2: Send any known type of experimental message to the simulation device and receive the simulation response result fed back by the simulation device;

[0053] Step 3: Adjust the payload of the current experimental message and send it back to the simulation device, and receive the simulation response result fed back by the simulation device again;

[0054] Step 4: Repeat step 3 until the payload byte group enumeration simulation verification of the current experimental message is completed, and record the number of simulated negative responses of the current experimental message.

[0055] In the embodiment of the present invention, a message generation model is obtained by training a generative adversarial network (GAN) model. Generally, a GAN model consists of two neural network models: a generator G and a discriminator D, wherein the generator G is used to learn to generate samples from an unknown distribution or a noise distribution, and the discriminator D is used to learn how to distinguish between original samples and generated samples from samples. When the GAN model trains two sub-models at the same time, a feature vector set including the message type, message sequence number, message length, message version number, and timestamp is used as the model input of the generator G, and then the generated samples that conform to the same distribution as the original samples are generated as the model output as much as possible; the input of the discriminator D consists of the generated samples and the original samples, and the goal is to distinguish the two samples. The output is a probability value, which is 1 if the input comes from the original sample and 0 if the input comes from the generated sample. At the same time, the discriminator D will also give feedback information to the generator G to guide the training of the generator G and update the parameters of the generator G. The goal of the generator G is to generate samples that can deceive the discriminator D. The goal of the discriminator D is to distinguish between the generated samples and the original samples. Through continuous adversarial training and optimization, a Nash equilibrium state is eventually reached. At this time, the probability value output by the discriminator D each time is 0.5 (which is equivalent to the discriminator D being unable to distinguish the sources of the two samples and can only make random guesses), and the parameters of the GAN model are optimized.

[0056] In an embodiment of the present invention, a message generation model is obtained by collecting multiple types of protocol messages supported by a gateway device, including standard protocol messages and private protocol messages, and using the collected multiple types of protocol messages to train a generative adversarial network (GAN) model. In a communication network, in order to classify unknown applications, it is usually necessary to collect network data using packet capture software such as Wireshark. Since these data are usually encapsulated according to the agreed network communication protocol before being transmitted in the communication network, after obtaining the network data traffic packet, it is also necessary to pre-process it to obtain the real message therein and perform relevant processing on the real message to obtain the required message set.

[0057] Specifically, the control server collects data packets supported by the gateway device, including standard protocol packets and private protocol packets; extracts message features from the collected data packets, including message type, message sequence number, message length, message version number, and timestamp, and constructs a feature vector set after preprocessing the message features; uses the feature vector set to train the generator and discriminator based on the GAN model respectively, and uses the trained generator G as the message generation model and the trained discriminator D as the message recognition model.

[0058] In the embodiment of the present invention, after the above-mentioned message generation model is used to generate multiple types of experimental messages supported by the actual gateway device, any known type of experimental message is sent to the simulation device, and the simulation program is used to process the experimental message.

[0059] On the simulation device side, the process of the simulation program processing the experimental message includes: caching the experimental message, then judging the message type based on the protocol type field of the experimental message, and then simulating the experimental message according to the message type of the experimental message. If the simulation program always runs normally, a positive simulation response is fed back to the control server. If the simulation program runs abnormally, a negative simulation response is fed back to the control server. After the simulation is completed, the experimental message and program exception information in the cache are deleted.

[0060] On the control server side, after receiving the simulation response result fed back by the simulation device, the payload portion of the current experimental message is adjusted, and then the message with the adjusted payload is re-sent to the simulation device, and the simulation response result fed back by the simulation device is received again, and the above steps are repeated until the payload byte group of the current experimental message is simulated and verified, and the number of simulation negative responses of the current experimental message is recorded. Generally, the payload refers to the valid information bytes in the cell excluding the cell header. The adjustment of the payload portion of the current experimental message described in the embodiment of the present invention includes: adjusting the payload length of the experimental message, or adjusting the payload content of the message payload of a specified length.

[0061] The control server is also used to receive the actual message type of the experimental message fed back by the simulation device and adjust the parameters of the message recognition model based on the actual message type of the experimental message. The control server determines whether the message type predicted by the message recognition model is consistent with the actual message type. If not, the message recognition model parameters are adjusted, and the message type is based on the message type fed back by the simulation device. In actual applications, the control server can also report messages that the message recognition model cannot recognize to the user end for processing, allowing the user to enter the message type.

[0062] The control server continuously adjusts the payload length of the experimental message, or adjusts the payload content of the message payload of a specified length, and then sends the experimental message to the simulation device for simulation testing until the payload byte group simulation verification of the experimental message is completed. The purpose is to find harmful payloads that will definitely affect the normal operation of the gateway device. During the payload byte group simulation verification process of the experimental message, when the control server receives a cumulative set number of simulated negative responses, it indicates that the payload portion of the experimental message is harmful to the actual gateway device and is likely to cause abnormal operation of the gateway device. The control server reports and issues an alarm, and at the same time marks the experiment as a defense message.

[0063] In an embodiment of the present invention, after the message generation model generates multiple types of experimental messages supported by the actual gateway device, it verifies the payload byte group of a known type of message and then replaces it with another type of experimental message for verification. Other types of experimental messages are processed in sequence according to the above steps 2-4. A comprehensive simulation test is performed on all protocol messages supported by the gateway device using a management and control server and simulation equipment to find abnormal messages harmful to the gateway device in advance, continuously improve the defense database, and send the found abnormal messages as defense messages to the gateway device. When the gateway device receives the same message as the defense message again, it does not respond, thereby improving the autonomous protection capability of the gateway device and the robustness of the gateway device.

[0064] like Figure 2 As shown, the second embodiment of the present invention further provides a device protection method, which is applied to a gateway device, and the method includes:

[0065] S5. After receiving the defense message, extract the payload portion of the defense message as the harmful payload according to the message type of the defense message;

[0066] S6. When a service message of the same type as the defense message is received again, if the payload portion of the service message successfully matches the harmful payload, the service message is not responded to; otherwise, the service message is processed normally.

[0067] In an embodiment of the present invention, after receiving a defense message, the gateway device identifies the message format of the defense message according to the message type of the defense message, and then extracts the payload part according to the message format of the defense message, including the payload length and payload content, and uses the payload part of the defense message as a harmful payload, and saves the message type and harmful payload of the defense message to the memory and disk file, so as to facilitate reloading of the relevant information of the harmful payload after the device is powered off and restarted.

[0068] When the gateway device receives a service message of the same type as the defense message again, it compares the payload part of the service message with the harmful payload stored in the memory or disk in full bytes. If the two are exactly the same, the match is successful and the gateway device will not respond to the service message subsequently. Otherwise, it will process the service message normally.

[0069] For example, when the gateway device receives a defense message sent by the control server, it identifies that the defense message is a UDP protocol message and the destination port is 7777. The gateway device saves the message type (UDP), port number (7777), harmful payload (payload length and payload content) and other information of the defense message to the local memory or disk file. When a business message with a UDP protocol message and a destination port of 7777 is received again, the payload part of the business message is stripped out and compared with the harmful payload of the corresponding defense message saved locally in full bytes. If the two are exactly the same, the newly received business message is considered to be harmful, and the business message is discarded or not responded to. Otherwise, the business message is processed normally.

[0070] In the embodiment of the present invention, the gateway device collects defense messages that may cause abnormal operation of the device in advance, and saves the message type and harmful payload of the defense message in the memory and disk file. When the gateway device receives a business message of the same type as the defense message again, the payload part of the business message is completely matched with the harmful payload in the memory or disk. If the match is successful, it means that the payload part of the business message may cause abnormal operation of the gateway device. The gateway device does not respond to the business message. The robustness of the gateway device is improved through this active defense method.

[0071] Based on the same inventive concept, an embodiment of the present invention further provides a computer storage medium, wherein the computer storage medium stores computer-executable instructions, and the computer-executable instructions can implement the aforementioned device protection method when executed.

[0072] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0073] The modules described as separate components may or may not be physically separate, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, the functional modules in the various embodiments of the present invention may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The integrated modules may be implemented in the form of hardware or software functional modules.

[0074] If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0075] It should be noted that for the aforementioned method embodiments, for ease of description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that the present invention is not limited by the order of the actions described, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0076] In the above embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the above embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the above embodiments or to replace some of the technical features therein with equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A device protection method, applied to a management and control server, characterized in that: The method comprises: Sending the experimental message to the simulation device for payload byte group enumeration simulation verification, and continuously receiving the simulation response result of the experimental message; When the simulated negative response received to the experimental message reaches a set number of times, an alarm is issued, and the experimental message is marked as a defense message; The defense message is sent to a gateway device, so that the gateway device does not respond when receiving a message identical to the defense message again.

2. The method according to claim 1, characterized in that When the simulation program of the simulation device can process the experimental message normally, the control server receives a simulation positive response fed back by the simulation device; When the simulation program of the simulation device processes the experimental message abnormally, the management and control server receives a simulation negative response fed back by the simulation device.

3. The method according to claim 1, characterized in that The step of sending the experimental message to the simulation device for payload byte group enumeration simulation verification, and continuously receiving the simulation response result of the experimental message includes: Step 1: Generate various types of experimental messages based on the message generation model; Step 2: Send any known type of experimental message to the simulation device, and receive the simulation response result fed back by the simulation device; Step 3: Adjust the payload part of the current experimental message and send it to the simulation device again, and receive the simulation response result fed back by the simulation device again; Step 4: Repeat step 3 until the payload byte group simulation verification of the current experimental message is completed, and record the number of simulated negative responses of the current experimental message.

4. The method according to claim 3, characterized in that: The step of adjusting the payload portion of the current experimental message includes: Adjust the payload length of the experimental message; Alternatively, the payload content of a message payload of a specified length is adjusted.

5. The method according to claim 3, characterized in that: Before generating experimental messages of various message types based on the message generation model, include: Collect data packets supported by the gateway device, including standard protocol packets and private protocol packets; Extracting message features from the collected data messages, including message type, message sequence number, message length, message version number, and timestamp, and constructing a feature vector set after preprocessing the message features; The feature vector set is used to train a generator and a discriminator based on a generative adversarial network (GAN) model, respectively, to obtain a message generation model and a message recognition model.

6. The method according to claim 5, characterized in that The method further comprises: The management and control server receives the real message type of the experimental message fed back by the simulation device, and adjusts the parameters of the message identification model according to the real message type of the experimental message.

7. A device protection method, applied to a gateway device, characterized in that: The method comprises: After receiving the defense message, extracting the payload part of the defense message as the harmful payload according to the message type of the defense message; When a service message of the same type as the defense message is received again, if the payload part of the service message successfully matches the harmful payload, the service message is not responded to, otherwise the service message is processed normally.

8. The method according to claim 7, characterized in that The step of extracting the payload portion of the defense message as the harmful payload according to the message type of the defense message includes: Identifying a message format of the defense message according to the message type of the defense message; Extracting a payload portion as a harmful payload according to a message format of the defense message, including a payload length and a payload content; The message type and harmful payload of the defense message are saved in memory and disk files.

9. The method according to claim 7 or 8, characterized in that: When a service message of the same type as the defense message is received again, the payload part of the service message is compared with the harmful payload in full bytes, and if the two are exactly the same, the match is successful.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed, implement the method described in any one of claims 1-6 or 7-9.

Images