Surveying and mapping resisting system based on high-performance multi-core transfer control separation

Abstract

The invention provides an anti-mapping system based on high-performance multi-core forwarding control separation. The system comprises a management visualization module used for configuring an anti-mapping rule and sending configuration data to a configuration receiving and information sending module; the configuration receiving and information sending module is used for receiving the configuration data and performing hot updating on the anti-mapping rule deployed on the data forwarding module according to the configuration data; the attack log from the data forwarding module is sent to the management visualization module to be displayed; the data forwarding module is used for receiving the message forwarded by the DPDK, matching the message with a surveying and mapping resisting rule and processing the message according to a matching result, and the processing modes comprise forwarding the message to a destination IP address through the DPDK, performing false response on the message and forwarding the message to a container for processing; wherein the configuration receiving and information sending module and the data forwarding module operate in different logic cores, and the different logic cores communicate with each other through a lock-ring-free queue.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an anti-mapping system based on high-performance multi-core control separation. Background Art

[0002] With the accelerating digitalization of cyberspace, cyberspace mapping technology, through active detection, protocol analysis, and asset profiling, constructs a "digital map" encompassing network topology, service fingerprints, and vulnerability distribution, providing attackers with precise guidance information. Mapping data plays a critical role in both initial and subsequent penetration of advanced persistent threat (APT) attacks—not only driving target selection and intelligence gathering, but also supporting the construction of the attack chain. Using cyberspace mapping technology, APT attackers systematically collect exposed information about target organizations, including IP addresses, domain names, service ports, and vulnerability signatures, to precisely locate high-value targets and plan attack paths to ensure stealth and success. Because intranet environments host core business systems, sensitive data assets, and critical infrastructure, the exposure of network node characteristics and connectivity directly amplifies security risks such as data leakage, lateral movement, and supply chain hijacking. This makes intranet anti-mapping a crucial strategic asset in cybersecurity defense systems.

[0003] Among the currently released technologies, deception defense, mobile target defense (MTD), and cell-based defense (CMD) are three representative active defense methods. Deception defense deploys false information or decoy nodes to disrupt attacker detection paths and enable tracing of attack behavior. Mobile target defense (MTD) employs dynamic strategies (such as randomizing IP addresses, ports, and protocol parameters) to periodically change system exposure, increasing the attacker's analysis cost. Cell-based defense (CMD) builds a heterogeneous, redundant, parallel system architecture, leveraging vulnerability variability to inherently protect against unknown threats.

[0004] The aforementioned defense technologies suffer from the following shortcomings and deficiencies: First, they still utilize traditional anti-mapping architectures, relying on the kernel protocol stack for traffic processing and the operating system for traffic filtering and response generation. This results in an insurmountable performance ceiling. In today's network environment, enterprise data center network bandwidth has reached 100Gbps, while national-level network infrastructure requires terabyte-level bandwidth. Due to inherent overhead such as interrupt processing, memory copying, and system calls, the average packet loss rate and latency fluctuation of mainstream anti-mapping systems are increasing. These performance deficiencies directly hinder defense systems from achieving real-time detection and blocking of detections. This creates a window of policy failure when countering high-intensity mapping attacks, allowing attackers to exploit this time lag to conduct topology reconnaissance and fingerprint extraction. Second, existing anti-mapping systems often rely on predefined rule libraries or static fingerprint feature libraries, resulting in a proliferation of detection methods targeting these detection models, creating a significant asymmetry between attack and defense. When confronted with tools capable of bypassing mapping techniques, traditional feature matching schemes experience a linear increase in both false positive and false negative rates. Third, the aforementioned anti-mapping technologies have low efficiency in virtual-real traffic coordination and insufficient mapping accuracy in a virtualized environment, and pose risks of resource contention and defense strategy leakage. Summary of the Invention

[0005] In order to solve the above problems, the present invention provides an anti-mapping system based on high-performance multi-core control separation.

[0006] The present invention provides an anti-mapping system based on high-performance multi-core control separation, comprising: a management visualization module, a configuration receiving and information sending module, and a data forwarding module; Management visualization module, used to configure anti-mapping rules and send configuration data to the configuration receiving and information sending module; A configuration receiving and information sending module, configured to receive configuration data and perform hot updates on the anti-mapping rules deployed on the data forwarding module according to the configuration data; and to send the attack logs received from the data forwarding module to the management visualization module for display; A data forwarding module, configured to receive messages forwarded by the DPDK, match the messages with locally deployed anti-mapping rules, and process the messages based on the matching results. The processing methods include forwarding the messages to the destination IP address through the DPDK, issuing false responses to the messages, and forwarding the messages to a container for processing. The configuration receiving and information sending module and the data forwarding module run in different logical cores, and information is exchanged between different logical cores through a non-locked loop queue.

[0007] Furthermore, the configuration receiving and information sending module includes a timing unit, a MySQL database operation unit and an enqueue unit; Timing unit, used to create and start timers; A MySQL database operation unit is configured to connect to the MySQL database when the timer expires; after the connection is established, obtain configuration data from the MySQL database according to a query instruction, and insert information to be sent into the MySQL database according to an insert instruction; The enqueue unit is used to put the configuration data obtained from the MySQL database into the lock-free queue.

[0008] Furthermore, the data forwarding module includes a packet classification unit, a rule matching unit and a packet forwarding unit; A packet classification unit, used to classify received messages according to protocol type; A rule matching unit is used to match the message with the anti-mapping rule according to the IP address and type of the message. If the message is a scanning detection message, a false response is given to the message; if the message is a topology detection message, the message is forwarded to the container through the virtual network card for processing; The packet forwarding unit is used to forward normal packets to the destination IP address through DPDK.

[0009] The beneficial effects of the present invention are: (1) The anti-mapping system of the present invention realizes high-performance data transmission by placing the configuration receiving and information sending module and the data forwarding module on different logical cores, separating the control plane from the data plane (transfer and control separation), and solving the significant performance bottleneck problem of existing anti-mapping technology.

[0010] (2) By managing the collaboration between the visualization module and the configuration receiving and information sending module, the anti-mapping rules deployed in the data forwarding module can be hot-updated, and then the blocking and false responses of various detection packets can be achieved based on rule matching, thus solving the problem of insufficient active defense capabilities of existing anti-mapping technologies against various bypass scans.

[0011] (3) By studying the packet diversion technology that supports virtualized network cards, we can achieve virtual-real mapping of data packets and solve the problems of resource contention and defense strategy leakage risks caused by the low efficiency of virtual-real traffic coordination and insufficient mapping accuracy of existing anti-mapping technologies in virtualized environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 An architectural design diagram of an anti-mapping system based on high-performance multi-core control separation provided by an embodiment of the present invention; Figure 2 A flowchart of the configuration receiving and information sending module provided in an embodiment of the present invention; Figure 3 A flow chart of a data forwarding module provided by an embodiment of the present invention; Figure 4 A visual interface of the rule configuration unit provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0013] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0014] Figure 1 The design architecture diagram of the anti-mapping system provided in an embodiment of the present invention includes a management visualization module, a configuration receiving and information sending module, and a data forwarding module.

[0015] Specifically, the management visualization module is used to configure anti-mapping rules and send the configuration data to the configuration receiving and information sending module; the configuration receiving and information sending module is used to receive the configuration data and perform hot updates on the anti-mapping rules deployed on the data forwarding module according to the configuration data; and send the attack logs received from the data forwarding module to the management visualization module for display; the data forwarding module is used to receive messages forwarded by the DPDK, match the messages with the locally deployed anti-mapping rules, and process the messages according to the matching results. The processing methods include forwarding the messages to the destination IP address through the DPDK, making false responses to the messages, and forwarding the messages to the container for processing. The data forwarding module and the configuration receiving and sending module utilize a multi-core processing framework with separate forwarding and control. This means the module and the data forwarding module run on separate logical cores, with information exchanged between the cores via a lockless queue. The data forwarding module receives configuration information from the module via a lockless queue and forwards data packets according to the configured rules. Packets that meet different rules are forwarded to different containers for processing. The data forwarding module also records attack logs, which are displayed based on the timing mechanism of the configuration receiving and sending module.

[0016] The configuration receiving and information sending modules use independent thread processing to avoid the performance loss caused by mixing with the forwarding thread. In one embodiment, the module timing unit, MySQL database operation unit and enqueue unit complete MySQL event processing, timer event processing and enqueue operation through the cooperation of three units.

[0017] Specifically, the timing unit is used to create and start a timer; the MySQL database operation unit is used to connect to the MySQL database when the timer expires; and after the connection, obtain configuration data from the MySQL database according to the query instruction, and insert the information to be sent into the MySQL database according to the insert instruction; the enqueue unit is used to put the configuration data obtained from the MySQL database query into the lock-free loop queue.

[0018] like Figure 2 The figure shows the flow chart for the configuration receiving and message sending modules. Timed event processing is handled in a separate thread, creating and starting a timer to begin timing. MySQL event processing involves a callback function that completes the MySQL connection and operations when the timer expires, completing the MySQL processing. For example, for configuration messages, query commands are used to retrieve information from the MySQL database and enqueue it. For message sending, insert commands are used to insert the information to be sent into the MySQL database and then close the database.

[0019] In one embodiment, the data forwarding module includes a packet classification unit, a rule matching unit, and a packet forwarding unit. Specifically, the packet classification unit is used to classify received packets according to protocol type; the rule matching unit is used to match packets with anti-mapping rules based on the IP address and type of the packet. If the packet is a scanning probe packet, a false response is issued to the packet; if the packet is a topology probe packet, the packet is forwarded to the container for processing via the virtual network card; and the packet forwarding unit is used to forward normal packets to the destination IP address via the DPDK.

[0020] like Figure 3 The following is a flowchart of the data forwarding module. When the DPDK receives a message, the packet classification unit classifies it according to protocol type and then forwards it to the rule matching unit. The rule matching unit extracts the anti-mapping rule configuration data from the ring queue and then performs rule matching based on the message's IP address and type. For messages that meet the topology detection requirements, the virtual network interface card is used to forward them to the container for processing. For messages that meet the scanning requirements, a false response is generated in real time. Finally, the data message is forwarded to the packet forwarding unit, which forwards the message based on the destination IP address.

[0021] Furthermore, in actual applications, the DPDK interface ports can be configured to shunt received packets. For example, when the DPDK receives a packet, it determines the packet processing based on the port where the packet was received. If the packet is received on port 0, it is directly forwarded to the rule matching unit to determine whether the packet meets the rules and is then passed on for different processing. If the packet is received on port 1, it is directly forwarded from port 0.

[0022] based on Figure 1 The anti-mapping system shown in the figure has the following overall process: (1) Users complete the configuration of anti-mapping rules through the management visualization module, including blocking and forwarding of mapping traffic; (2) After the anti-mapping rule configuration is completed, the management visualization module will send the configuration data to the configuration receiving and information sending module; (3) Since DPDK uses a multi-core forwarding framework, the configuration receiving and information sending modules run in separate logical cores, and the data forwarding module runs in a different logical core. Different cores implement hot updates of rules through a lock-free queue architecture; (4) After the configuration is completed, the system receives messages from the network through the DPDK multi-core framework and multi-threading; (5) The data forwarding module classifies the received message according to the message header, and then sends it to the rule matching unit to complete the mapping rule matching. If the message is a scanning detection message, a false response is made to the message and it is replied; Figure 4 It is the visual interface of the rule matching unit.

[0023] (6) The message that completes the rule matching is sent to the intranet by the packet forwarding unit or sent to the container through the virtual network card for processing; (7) For the attack message logs during the system operation process, the data forwarding module sends the logs to the ring queue through the DPDK's lock-free ring queue mechanism; (8) Configure the thread occupied by the receiving and information sending module to receive the data from the lock-free queue, and send the data to the information visualization interface of the management visualization module through the timing function for display.

[0024] This invention achieves breakthrough optimization through multi-dimensional technological innovation to address core defects of existing anti-mapping technologies, such as performance bottlenecks caused by reliance on the kernel protocol stack, difficulty of static rule bases in coping with new detection tools, and low efficiency of traffic coordination in virtualized environments. It has the following advantages: (1) Based on the DPDK user-mode driver and multi-core control separation architecture, it completely bypasses the interrupt processing and memory copy overhead of the kernel protocol stack, breaking through the performance ceiling of traditional solutions at the bottom layer and meeting the real-time defense needs of the national T-level bandwidth infrastructure.

[0025] (2) In response to the inherent defects of the static rule base, a hot update and real-time response mechanism of the rules is introduced to protect the system from quickly identifying and blocking new attacks, reducing the false alarm rate and missed alarm rate, maintaining the dynamic effectiveness of the defense strategy, and improving the detection accuracy of scanning tools.

[0026] (3) To address the collaborative efficiency and security risks of virtualization scenarios, hardware virtualization direct access and dynamic traffic labeling technology are used to achieve precise diversion of virtual and real traffic. At the same time, combined with DPDK memory pool reuse and microservice control plane design, the CPU usage of the virtualization environment is reduced.

[0027] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. An anti-mapping system based on high-performance multi-core control separation, characterized in that: include: Management visualization module, configuration reception and information sending module and data forwarding module; Management visualization module, used to configure anti-mapping rules and send configuration data to the configuration receiving and information sending module; A configuration receiving and information sending module, configured to receive configuration data and perform hot updates on the anti-mapping rules deployed on the data forwarding module according to the configuration data; and to send the attack logs received from the data forwarding module to the management visualization module for display; A data forwarding module, configured to receive messages forwarded by the DPDK, match the messages with locally deployed anti-mapping rules, and process the messages based on the matching results. The processing methods include forwarding the messages to the destination IP address through the DPDK, issuing false responses to the messages, and forwarding the messages to a container for processing. The configuration receiving and information sending module and the data forwarding module run in different logical cores, and information is exchanged between different logical cores through a non-locked loop queue.

2. The anti-mapping system based on high-performance multi-core control separation according to claim 1 is characterized in that: The configuration receiving and information sending module includes a timing unit, a MySQL database operation unit and an enqueue unit; Timing unit, used to create and start timers; A MySQL database operation unit is configured to connect to the MySQL database when the timer expires; after the connection is established, obtain configuration data from the MySQL database according to a query instruction, and insert information to be sent into the MySQL database according to an insert instruction; The enqueue unit is used to put the configuration data obtained from the MySQL database into the lock-free queue.

3. The anti-mapping system based on high-performance multi-core control separation according to claim 1 is characterized in that: The data forwarding module includes a packet classification unit, a rule matching unit and a packet forwarding unit; A packet classification unit, used to classify received messages according to protocol type; A rule matching unit is used to match the message with the anti-mapping rule according to the IP address and type of the message. If the message is a scanning detection message, a false response is given to the message; if the message is a topology detection message, the message is forwarded to the container through the virtual network card for processing; The packet forwarding unit is used to forward normal packets to the destination IP address through DPDK.

Images