A device protection method and a computer-readable storage medium

Abstract

This invention relates to the field of network security technology, and more particularly to a device protection method applied to a management server. The method includes: sending experimental packets to a simulation device for payload byte aggregation simulation verification, and continuously receiving simulation response results of the experimental packets; issuing an alarm when the cumulative number of received simulation negative responses to the experimental packets reaches a set number, and marking the experimental packets as defensive packets; and sending the defensive packets to a gateway device, so that the gateway device will not respond when it receives a packet identical to the defensive packet again. This invention utilizes a simulation device to pre-identify packets harmful to the gateway device as defensive packets, sending these defensive packets to the gateway device, and preventing the gateway device from responding when it receives a packet with a payload matching the defensive packet again, thus improving device robustness.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a device protection method and a computer-readable storage medium. Background Technology

[0002] Current network devices, due to inherent functional defects, often experience disruptions to existing network services upon restarting when handling abnormal packets. When the device receives the same type of packet again, it restarts repeatedly unless a patch or upgrade is implemented. Therefore, improving the device's ability to defend against abnormal packets is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0003] This invention provides a device protection method and a computer-readable storage medium, which aims to identify harmful abnormal messages in the device through simulation testing and improve device robustness by actively defending against them.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] Firstly, a device protection method for management servers is provided, including:

[0006] The experimental message is sent to the simulation device for payload byte group enumeration simulation verification, and the simulation response results of the experimental message are continuously received.

[0007] When the number of simulated negative responses received from the experimental message reaches a set number, an alarm is triggered, and the experimental message is marked as a defense message.

[0008] The defense message is sent to the gateway device, which is configured not to respond when the gateway device receives the same message again.

[0009] Furthermore, the step of sending the experimental message to the simulation device for payload byte group enumeration simulation verification and continuously receiving the simulation response results of the experimental message includes:

[0010] Step 1: Generate various types of experimental messages based on the message generation model;

[0011] Step 2: Send any known type of experimental message to the simulation device and receive the simulation response results from the simulation device;

[0012] Step 3: After adjusting the payload portion of the current experimental message, resend it to the simulation device and receive the simulation response results from the simulation device again.

[0013] Step 4: Repeat step 3 until the payload bytes of the current experimental message are fully simulated and verified. Record the number of simulated negative responses of the current experimental message.

[0014] Furthermore, when the simulation program of the simulation device can process the experimental messages normally, the control server receives the simulation positive response from the simulation device;

[0015] When the simulation program of the simulation device encounters an error in processing the experimental message, the control server receives a negative simulation response from the simulation device.

[0016] Furthermore, the adjustment of the payload portion of the current experimental message includes:

[0017] Adjust the payload length of the experimental message;

[0018] Alternatively, adjust the payload content for a specified length of message payload.

[0019] Furthermore, before generating experimental messages of various message types based on the message generation model, the following steps are included:

[0020] Collect data packets supported by the gateway device, including standard protocol packets and private protocol packets;

[0021] Extract message features from the collected data messages, including message type, message sequence number, message length, message version number, and timestamp. After preprocessing the message features, construct a feature vector set.

[0022] The generator and discriminator based on the Generative Adversarial Network (GAN) model are trained using the feature vector set to obtain the message generation model and message recognition model.

[0023] Furthermore, the method also includes:

[0024] The control server receives the actual message type of the experimental message from the simulation device and adjusts the parameters of the message recognition model according to the actual message type of the experimental message.

[0025] Secondly, a device protection method for gateway devices is provided, including:

[0026] Upon receiving a defense message, the payload portion of the defense message is extracted as a harmful payload based on the message type of the defense message.

[0027] When a service message of the same type as the defense message is received again, if the payload portion of the service message matches the harmful payload, the service message is not responded to; otherwise, the service message is processed normally.

[0028] Further, the step of extracting the payload portion of the defense message as a harmful payload based on the message type of the defense message includes:

[0029] Identify the message format based on the message type of the defense message;

[0030] The payload portion, including payload length and payload content, is extracted based on the packet format of the defense message.

[0031] The message type and harmful payload of the defense message are saved to memory and disk files.

[0032] Furthermore, when a service message of the same type as the defense message is received again, the payload portion of the service message is compared byte-by-byte with the harmful payload. If the two are completely identical, the match is successful.

[0033] Based on the same inventive concept, a computer storage medium is also provided, wherein computer executable instructions are stored in the computer storage medium, and the aforementioned device protection method is implemented when the computer executable instructions are executed.

[0034] The technical effects and advantages of this invention are as follows:

[0035] (1) The message generation model learns the standard protocol messages and private protocol messages supported by the actual gateway device and generates various types of experimental messages for device testing.

[0036] (2) Use simulation equipment to perform payload byte grouping simulation verification on experimental messages. The management server determines that experimental messages whose cumulative negative simulated responses reach a set number of times are harmful to the actual gateway device and marks them as defense messages.

[0037] (3) The defense message is sent to the gateway device. When the gateway device receives the same message again, it does not respond, which enables the gateway device to actively defend against the defense message and improves the robustness of the device.

[0038] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating the device protection method provided in the first embodiment of the present invention;

[0041] Figure 2 This is a flowchart illustrating the device protection method provided in the second embodiment of the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] To improve the active protection capabilities of devices, the first embodiment of this invention provides a device protection method applied to a management server, such as... Figure 1 As shown, the method includes the following steps:

[0044] S1. Send the experimental message to the simulation device for payload byte group enumeration simulation verification, and continuously receive the simulation response results of the experimental message;

[0045] S2. When the cumulative number of simulated negative responses received from the experimental message reaches a set number, an alarm is triggered, and the experimental message is marked as a defense message.

[0046] S3. Send the defense message to the gateway device, so that the gateway device will not respond when it receives the same message as the defense message again.

[0047] The control server sends the experimental message to the simulation device, which uses the simulation program to preprocess the message. If the simulation program can process the message normally, the simulation device sends a positive response to the control server. If the simulation program processes the message abnormally, the simulation device sends a negative response to the control server.

[0048] In this embodiment of the invention, a simulation device is used to perform payload byte aggregation simulation verification on the experimental message. During the payload byte aggregation simulation verification process, when the cumulative number of negative simulation responses received by the management server reaches a set number, it indicates that the experimental message may be harmful to the actual gateway device. The management server reports an alarm and marks the experimental message as a defensive message. This embodiment of the invention uses a management server and a simulation device to perform simulation testing on the experimental message, identifying harmful messages that may cause abnormal operation of the actual gateway device in advance. These harmful messages are sent to the gateway device as defensive messages. When the gateway device receives the same message again, it does not respond, enabling the gateway device to proactively defend against harmful messages and improving device robustness.

[0049] According to an embodiment of the present invention, the management server generates experimental messages according to the message protocol format, or collects data messages from network devices (such as switches, routers, etc.) in the current network and generates a message generation model that can generate various types of messages through offline learning.

[0050] The above step S1 specifically includes:

[0051] Step 1: Generate various types of experimental messages based on the message generation model;

[0052] Step 2: Send any known type of experimental message to the simulation device and receive the simulation response results from the simulation device;

[0053] Step 3: After adjusting the payload portion of the current experimental message, resend it to the simulation device and receive the simulation response results from the simulation device again.

[0054] Step 4: Repeat step 3 until the payload bytes of the current experimental message are fully simulated and verified. Record the number of simulated negative responses of the current experimental message.

[0055] In this embodiment of the invention, a message generation model is obtained by training a Generative Adversarial Network (GAN) model. Generally, a GAN model consists of two neural network models: a generator G and a discriminator D. The generator G learns to generate samples from an unknown or noisy distribution, while the discriminator D learns how to distinguish between original and generated samples. When training both sub-models simultaneously, the GAN model uses a set of feature vectors, including message type, message sequence number, message length, message version number, and timestamp, as input to the generator G. It then generates samples that conform to the same distribution as the original samples as possible as the model output. The discriminator D's input consists of generated and original samples, and its goal is to distinguish between the two types of samples. Its output is a probability value: 1 if the input comes from the original sample, and 0 if the input comes from the generated sample. Simultaneously, the discriminator D also provides feedback to the generator G to guide its training and update its parameters. The goal of generator G is to generate generated samples that can deceive discriminator D. The goal of discriminator D is to distinguish between generated samples and original samples. Through continuous adversarial training and optimization, a Nash equilibrium is eventually reached, at which point the probability value output by discriminator D is 0.5 each time (equivalent to discriminator D being unable to distinguish the source of the two samples and can only guess randomly), and the parameters of the GAN model reach their optimal state.

[0056] In this embodiment of the invention, various types of protocol messages supported by the gateway device are collected, including standard protocol messages and proprietary protocol messages. These collected protocol messages are then used to train a Generative Adversarial Network (GAN) model, resulting in a message generation model. In communication networks, to classify unknown applications, network data is typically collected using packet capture software such as Wireshark. Since this data is usually encapsulated according to agreed-upon network communication protocols before transmission, preprocessing is required after obtaining the network data packets to extract the actual messages. Further processing of these actual messages is then necessary to obtain the required message set.

[0057] Specifically, the management server collects data packets supported by the gateway device, including standard protocol packets and private protocol packets; extracts packet features from the collected data packets, including packet type, packet sequence number, packet length, packet version number, and timestamp; constructs a feature vector set after preprocessing the packet features; and trains a generator and discriminator based on the GAN model using the feature vector set, using the trained generator G as the packet generation model and the trained discriminator D as the packet recognition model.

[0058] In this embodiment of the invention, after generating various types of experimental messages supported by the actual gateway device using the above-mentioned message generation model, an experimental message of any known type is sent to the simulation device, and the simulation program processes the experimental message.

[0059] On the simulation device side, the process of the simulation program processing experimental messages includes: caching the experimental messages, then determining the message type based on the protocol type field of the experimental message, and then performing simulation processing on the experimental message according to the message type. If the simulation program always runs normally, it sends a positive simulation response to the management server. If the simulation program runs abnormally, it sends a negative simulation response to the management server. After the simulation ends, the experimental messages and program error information in the cache are deleted.

[0060] On the management server side, after receiving the simulation response result from the simulation device, the payload portion of the current experimental message is adjusted. Then, the message with the adjusted payload is resent to the simulation device, and the simulation response result is received again. This process is repeated until the payload byte grouping simulation verification of the current experimental message is completed, and the number of negative simulation responses for the current experimental message is recorded. Generally, the payload refers to the valid information bytes in a cell excluding the cell header. Adjusting the payload portion of the current experimental message as described in this embodiment includes: adjusting the payload length of the experimental message, or adjusting the payload content for a specified length of packet payload.

[0061] The control server is also used to receive the actual message types of experimental messages fed back by the simulation equipment, and adjust the parameters of the message recognition model according to the actual message types. By determining whether the message type predicted by the message recognition model is consistent with the actual message type, if they are inconsistent, the parameters of the message recognition model are adjusted, and the message type is based on the message type fed back by the simulation equipment. In practical applications, the control server can also report messages that the message recognition model cannot recognize to the user terminal for processing, allowing the user to input the message type manually.

[0062] The control server continuously adjusts the payload length of experimental packets, or adjusts the payload content of packets of a specified length, before sending the experimental packets to the simulation device for simulation testing. This process continues until the payload byte aggregation simulation verification of the experimental packets is completed. The purpose is to identify harmful payloads that may affect the normal operation of the gateway device. During the payload byte aggregation simulation verification process of the experimental packets, when the cumulative number of negative simulation responses received by the control server reaches a set number, it indicates that part of the payload of the experimental packets is harmful to the actual gateway device and is highly likely to cause abnormal operation of the gateway device. The control server reports this and issues an alarm, while also marking the experimental packet as a defense packet.

[0063] In this embodiment of the invention, after the message generation model generates multiple types of experimental messages supported by the actual gateway device, it performs a payload byte group verification on a known type of message before switching to another type of experimental message for verification. This process is repeated sequentially according to steps 2-4 above. A comprehensive simulation test is conducted on all protocol messages supported by the gateway device using a management server and simulation equipment. This proactively identifies anomalous messages harmful to the gateway device, continuously improves the defense database, and sends the identified anomalous messages as defense messages to the gateway device. When the gateway device receives a message identical to the defense message again, it does not respond, thereby improving the gateway device's autonomous protection capability and robustness.

[0064] like Figure 2 As shown, the second embodiment of the present invention also provides a device protection method applied to a gateway device, the method comprising:

[0065] S5. Upon receiving a defense message, extract the payload portion of the defense message as a harmful payload based on the message type of the defense message.

[0066] S6. When a service message of the same type as the defense message is received again, if the payload of the service message matches the harmful payload, the service message is not responded to; otherwise, the service message is processed normally.

[0067] In this embodiment of the invention, after receiving a defense message, the gateway device identifies its message format according to the message type of the defense message, and then extracts the payload part according to the message format of the defense message, including the payload length and payload content. The payload part of the defense message is regarded as a harmful payload, and the message type of the defense message and the harmful payload are saved to memory and disk files, so that the relevant information of the harmful payload can be reloaded after the device is powered off and restarted.

[0068] When the gateway device receives a service message of the same type as the defense message again, it performs a full-byte comparison between the payload of the service message and the harmful payload stored in memory or disk. If the two are completely identical, the match is successful, and the gateway device will not respond to the service message subsequently; otherwise, it will process the service message normally.

[0069] For example, when a gateway device receives a defense message from a management server, it identifies the defense message as a UDP protocol message with a destination port of 7777. The gateway device saves information such as the message type (UDP), port number (7777), and harmful payload (payload length and payload content) of the defense message to local memory or a disk file. When it receives another UDP protocol message with a destination port of 7777, it extracts the payload of the service message and compares it byte-by-byte with the harmful payload of the corresponding defense message stored locally. If the two are completely identical, the newly received service message is considered harmful, and the service message is discarded or not responded to. Otherwise, the service message is processed normally.

[0070] In this embodiment of the invention, the gateway device collects defense messages that may cause abnormal device operation in advance, and saves the message type and harmful payload of the defense messages to memory and disk files. When the gateway device receives a service message of the same type as the defense message again, it performs a full match between the payload of the service message and the harmful payload in memory or disk. If the match is successful, it means that the payload of the service message may cause abnormal operation of the gateway device, and the gateway device does not respond to the service message. This proactive defense method improves the robustness of the gateway device.

[0071] Based on the same inventive concept, embodiments of the present invention also provide a computer storage medium storing computer-executable instructions, which, when executed, implement the aforementioned device protection method.

[0072] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0073] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, the functional modules in the various embodiments of this invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0074] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0075] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0076] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not described in detail in a particular embodiment can be found in the relevant descriptions of other embodiments. Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A device protection method, applied to a management and control server, characterized in that, The method includes: The experimental message is sent to the simulation device for payload byte group enumeration simulation verification, and the simulation response results of the experimental message are continuously received. The process involves collecting data packets supported by the gateway device, including standard protocol packets and private protocol packets; extracting packet features from the collected data packets, including packet type, packet sequence number, packet length, packet version number, and timestamp; preprocessing the packet features to construct a feature vector set; and using the feature vector set to train a generator and a discriminator based on a Generative Adversarial Network (GAN) model to obtain a packet generation model and a packet recognition model. Generate various types of experimental messages based on the message generation model; send any known type of experimental message to the simulation device and receive the simulation response results from the simulation device; adjust the payload length of the current experimental message, or adjust the payload content of a message payload of a specified length and resend it to the simulation device, and receive the simulation response results from the simulation device again. Repeat this step until the payload byte grouping simulation verification of the current experimental message is completed, and record the number of simulation negative responses of the current experimental message. When the number of simulated negative responses received from the experimental message reaches a set number, an alarm is triggered, and the experimental message is marked as a defense message. The defense message is sent to the gateway device, which is configured not to respond when the gateway device receives the same message again.

2. The method according to claim 1, characterized in that, When the simulation program of the simulation device can process the experimental message normally, the control server receives the simulation positive response from the simulation device. When the simulation program of the simulation device encounters an error in processing the experimental message, the control server receives a negative simulation response from the simulation device.

3. The method according to claim 1, characterized in that, The method further includes: The control server receives the actual message type of the experimental message from the simulation device and adjusts the parameters of the message recognition model according to the actual message type of the experimental message.

4. A device protection method applied to a gateway device, wherein the gateway device communicates with a management server performing the method according to any one of claims 1 to 3, characterized in that, The method includes: Upon receiving a defense message, the payload portion of the defense message is extracted as a harmful payload based on the message type of the defense message. When a service message of the same type as the defense message is received again, if the payload portion of the service message matches the harmful payload, the service message is not responded to; otherwise, the service message is processed normally.

5. The method according to claim 4, characterized in that, The step of extracting the payload portion of the defense message as a harmful payload based on the message type of the defense message includes: Identify the message format based on the message type of the defense message; The payload portion, including payload length and payload content, is extracted based on the packet format of the defense message. The message type and harmful payload of the defense message are saved to memory and disk files.

6. The method according to claim 4 or 5, characterized in that, When a service message of the same type as the defense message is received again, the payload portion of the service message is compared byte-by-byte with the harmful payload. If the two are completely identical, the match is successful.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed, implement the method described in any one of claims 1-3 or 4-6.

Images