Method for improving network security, electronic equipment and readable medium
Patent Information
- Application Number
- CN202380094046.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-02-23
- Publication Date
- 2025-10-03
AI Technical Summary
When existing technologies ensure network security, hardware-based detection lacks flexibility and is difficult to configure and redefine, while purely software-based detection is subject to resource constraints and is difficult to effectively respond to network security threats.
Adopt a system that combines hardware and software to receive and analyze network traffic packets through the network card, use the data layer and man-in-the-middle attack tools to filter malicious packets, and put a network accelerator in front of the TCP/IP model to quickly filter malicious packets and ensure network traffic Package security.
It can quickly and effectively ensure network security during the operation of control device applications, save computing resources, improve processing speed and flexibility, and avoid the negative impact of data leakage on corporate reputation.
Smart Images
Figure CN120752893A_ABST
Abstract
Description
Method, electronic device and readable medium for improving network security Technical Field
[0001] The embodiments of the present application mainly relate to the field of network security, and in particular to a method, electronic device, and readable medium for improving network security. Background Art
[0002] Unauthorized network activity, often involving the theft of network resources, almost always compromises network security. As the world becomes increasingly digital, cybersecurity threats have undoubtedly become a part of our daily lives. With network security breaches becoming increasingly common, enterprise network security is paramount. It not only impacts the normal operation of an enterprise, but also negatively impacts its reputation if a data breach occurs. Traditional methods for ensuring network security include hardware-based detection or purely software-based detection. Hardware-based detection relies on rigid rules, lacks flexibility, and is difficult to configure and redefine, while purely software-based detection is sometimes subject to resource constraints.
[0003] Summary of the Invention
[0004] The embodiments of the present application provide a method for improving network security, an electronic device, and a readable medium for quickly and effectively ensuring network security of an application that controls a first device during operation, and further saving computing resources in processing network traffic packets.
[0005] In a first aspect, a system for improving network security is provided, comprising: a network card, configured to: receive a network traffic packet sent by a controller for controlling the operation of a first device; send the network traffic packet to a driver of a first space of an operating system; the driver of the first space of the operating system is configured to: parse the network traffic packet to obtain a first network traffic packet so that the operating system can read the content therein; a network accelerator of the first space of the operating system comprises a data layer and a man-in-the-middle attack tool; the data layer is configured to: parse the properties of the first network traffic packet; the man-in-the-middle attack tool is configured to: filter malicious packets in the first network traffic packet according to the properties of the first network traffic packet to obtain a second network traffic packet; the TCP / IP model of the first space of the operating system is configured to: parse the second network traffic packet to establish communication with the first application layer of the second space of the operating system; the first application layer of the second space of the operating system comprises a conversion module, and the conversion model is configured to: perform data conversion on the second network traffic packet so that the first application layer can run.
[0006] In a second aspect, a method for improving network security is provided, comprising: parsing a network traffic packet to obtain a first network traffic packet so that an operating system can read the contents thereof; wherein the network traffic packet includes a network traffic packet sent by a controller for controlling the operation of a first device; parsing the properties of the first network traffic packet; filtering malicious packets in the first network traffic packet according to the properties of the first network traffic packet to obtain a second network traffic packet; parsing the second network traffic packet to establish communication with a first application layer in a second space of the operating system; and performing data conversion on the second network traffic packet so that the first application layer can run.
[0007] In a third aspect, an electronic device is provided, comprising: at least one memory configured to store computer-readable code; and at least one processor configured to call the computer-readable code and execute each step of the method provided in the second aspect.
[0008] In a fourth aspect, a computer-readable medium is provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the processor executes the steps in the method provided in the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS
[0009] The following figures are intended only to illustrate and explain the embodiments of the present application and are not intended to limit the scope of the embodiments of the present application.
[0010] FIG1 is a schematic diagram of a system for improving network security according to an embodiment of the present application;
[0011] FIG2 is a flow chart of a method for improving network security according to an embodiment of the present application;
[0012] FIG3 is a schematic diagram of an electronic device according to an embodiment of the present application.
[0013] Description of Reference Numerals DETAILED DESCRIPTION
[0014] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that discussing these embodiments is merely to enable those skilled in the art to better understand and implement the subject matter described herein, and is not intended to limit the scope of protection, applicability, or examples set forth in the claims. The functions and arrangements of the elements discussed may be changed without departing from the scope of protection of the embodiments of the present application. Various examples may omit, replace, or add various processes or components as needed. For example, the described method may be performed in an order different from the described order, and various steps may be added, omitted, or combined. In addition, the features described relative to some examples may also be combined in other examples.
[0015] As used herein, the term "including" and its variations are open terms meaning "including but not limited to". The term "based on" means "based at least in part on". The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other definitions may be included below, whether explicit or implicit. Unless the context clearly indicates otherwise, the definition of a term is consistent throughout the specification.
[0016] The embodiments of the present application are described in detail below with reference to the accompanying drawings.
[0017] FIG1 is a schematic diagram of a system 100 for improving network security according to an embodiment of the present application. As shown in FIG1 , the system 100 for improving network security includes:
[0018] The network card 110 is configured to: receive a network traffic packet sent by the controller for controlling the operation of the first device; and send the network traffic packet to the driver 121 of the first space 120 of the operating system.
[0019] The driver 121 of the first space 120 of the operating system is configured to parse the network traffic packet and obtain the first network traffic packet so that the operating system can read the content therein.
[0020] The network accelerator 122 of the first space 120 of the operating system includes a data layer and a man-in-the-middle attack tool, wherein the data layer is configured to: parse the attributes of the first network traffic packet.
[0021] The man-in-the-middle attack tool is configured to: filter malicious packets in the first network traffic packet according to the attribute of the first network traffic packet to obtain a second network traffic packet.
[0022] The TCP / IP model 123 of the first space 120 of the operating system is configured to parse the second network traffic packet to establish communication with the first application layer of the second space of the operating system.
[0023] The first application layer 131 of the second space 130 of the operating system includes a conversion module, and the conversion model is configured to perform data conversion on the second network traffic packet so that the first application layer 131 can run.
[0024] Optionally, the network accelerator 122 may select one of the following: eBPF, XDP, or DPDK.
[0025] Optionally, the operating system first space 120 is a kernel space, and the operating system second space 130 is a user space. Optionally, the operating system may be a Linux operating system.
[0026] Optionally, the attribute of the first network traffic packet includes at least one of the following: length, type or status.
[0027] In one embodiment, the man-in-the-middle attack tool filters malicious packets from the first network traffic packet. The specific method may be as follows:
[0028] Step 1: Determine whether the current traffic packet comes from the same host as the previous traffic packet. If so, proceed to step 2; if not, add a unique identifier to the current traffic packet and proceed to step 2.
[0029] Step 2: Determine whether the destination address of the current traffic packet is the same as the source address saved last time. If so, proceed to step 3; if not, determine the current traffic packet as a normal packet.
[0030] Step 3: Determine whether the source address of the current traffic packet is the same as the last saved source address. If so, proceed to step 4; if not, determine the current traffic packet as a normal packet.
[0031] Step 4: Determine whether the source address of the current traffic packet is the same as the previously saved destination address. If so, the current traffic packet is considered a man-in-the-middle attack, i.e., a malicious packet; if not, the current traffic packet is considered a normal packet.
[0032] Step 5: Save the source address and destination address of the current secondary traffic packet that is judged to be a normal packet.
[0033] In one embodiment, the first application layer 131 of the second space 130 of the operating system further includes a control layer, which is configured to: receive control commands from the user side. The control commands are sent to the data layer of the network accelerator 122 of the first space 120 of the operating system, so that the data layer performs data cleaning on the second network traffic packet according to the corresponding control command. Optionally, data cleaning refers to removing redundant data, or eliminating all data related to the IP address specified by the user. Through data cleaning, the amount of data that needs to be calculated during the processing can be reduced, thereby further saving computing resources and improving processing speed.
[0034] In one embodiment, the first application layer 131 of the operating system's second space 130 further includes a control layer, configured to receive control commands from a user side and determine whether the computing resources of the data layer of the network accelerator 122 of the operating system's first space 120 can satisfy the corresponding control commands. If the computing resources of the data layer can satisfy the corresponding control commands, the corresponding control commands are sent to the data layer, causing the data layer to perform data scrubbing on the second network traffic packet in accordance with the corresponding control commands. If the computing resources of the data layer cannot satisfy the corresponding control commands, the control layer performs data scrubbing on the second network traffic packet in accordance with the corresponding control commands. Optionally, the situation where the computing resources of the data layer cannot satisfy the relevant control commands is, for example, as follows: assuming scenario 1, within a preset time period, such as 60 seconds, when the control layer detects that the number of relevant ICMP packets in the second network traffic packet exceeds a preset threshold, the control layer performs data scrubbing on the second network traffic packet in accordance with the control command sent from the user side. assuming scenario 2, when the control layer detects that the relevant TCP sequence numbers in the second network traffic packet are confused, the control layer determines that an identity spoofing attack has occurred and performs data scrubbing on the second network traffic packet.
[0035] In one embodiment, the control layer is also used to collect logs of communications between the control layer and the data layer. In addition, both the control layer and the data layer have the function of forwarding data.
[0036] The system for improving network security disclosed in this embodiment is a system that combines software and hardware. By placing the network accelerator 122 of the first space 120 of the operating system in front of the step of parsing the network traffic packet of the TCP / IP model, the amount of data required to be processed by the TCP / IP model can be greatly reduced. In addition, the network accelerator is configured to include a data layer and a man-in-the-middle attack tool. Through the combination of the two, malicious packets in the network traffic packets sent by the controller for controlling the operation of the first device can be quickly filtered, thereby ensuring that the network traffic packets entering the TCP / IP model are already safe network traffic packets. Ultimately, the network security of the application that controls the first device during operation can be quickly and effectively guaranteed.
[0037] FIG2 is a flow chart of a method for improving network security according to an embodiment of the present application. As shown in FIG2 , the method 200 for improving network security includes:
[0038] Step 201 , parse the network traffic packet to obtain a first network traffic packet so that the operating system can read the content thereof; wherein the network traffic packet includes a network traffic packet sent by the controller for controlling the operation of the first device.
[0039] Step 202: parse the attributes of the first network traffic packet.
[0040] Step 203: Filter malicious network packets in the first network traffic packet according to the attribute of the first network traffic packet to obtain a second network traffic packet.
[0041] Step 204: parse the second network traffic packet to establish communication with the first application layer of the second space of the operating system.
[0042] In step 205, the second network traffic packet is converted so that the first application layer can run, thereby securely controlling the operation of the first device through the first application layer.
[0043] In one embodiment, a control command from the user side may be received before step 204. According to the control command, data cleaning is performed on the second network traffic packet.
[0044] In one embodiment, before step 204, a control command from the user side may be received. A determination is made as to whether the computing resources of the data layer can satisfy the control command. If the computing resources of the data layer can satisfy the control command, the control command is sent to the data layer, so that the data layer performs data scrubbing on the second network traffic packet according to the control command. If the computing resources of the data layer cannot satisfy the control command, after step 205, the control layer performs data scrubbing on the second network traffic packet according to the control command.
[0045] A method for improving network security disclosed in an embodiment of the present application can quickly and effectively ensure network security of an application that controls a first device during operation.
[0046] The present application also provides an electronic device 300. FIG3 is a schematic diagram of an electronic device 300 according to an embodiment of the present application. As shown in FIG3 , the electronic device 300 includes a memory 301 and a processor 302. The memory 301 stores computer-readable code, which is executed by the processor 302 to implement the method 200 described above.
[0047] Among them, at least one processor 302 may include a microprocessor, an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a central processing unit (CPU), a graphics processing unit (GPU), a state machine, etc. Embodiments of computer-readable media include, but are not limited to, floppy disks, CD-ROMs, magnetic disks, memory chips, ROMs, RAMs, ASICs, configured processors, all-optical media, all tapes or other magnetic media, or any other medium from which a computer processor can read instructions. In addition, various other forms of computer-readable media can send or carry instructions to a computer, including routers, private or public networks, or other wired and wireless transmission devices or channels. Instructions may include code in any computer programming language, including C, C++, C language, Visual Basic, Java, and JavaScript.
[0048] In addition, an embodiment of the present application further provides a computer-readable medium having computer-readable instructions stored thereon. When the computer-readable instructions are executed by a processor, the processor executes the method 200 described above. Examples of computer-readable media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROMs, CD-Rs, CD-RWs, DVD-ROMs, DVD-RAMs, DVD-RWs, DVD+RWs), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the computer-readable instructions may be downloaded from a server computer or a cloud via a communication network.
[0049] It should be noted that not all steps and modules in the above processes and system structure diagrams are required, and certain steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by certain components in multiple independent devices.
Claims
1. A system for improving network security, comprising: - A network card (110), configured as follows: - receiving a network traffic packet sent by the controller for controlling the operation of the first device; -sending the network traffic packet to the driver (121) of the first space (120) of the operating system; - the driver (121) of the first space (120) of the operating system is configured as follows: - parsing the network traffic packet to obtain a first network traffic packet so that the operating system can read the content thereof; - the network accelerator (122) of the first space (120) of the operating system includes a data layer and a man-in-the-middle attack tool; - the data layer is configured to: - parsing the attributes of the first network traffic packet; -The man-in-the-middle attack tool is configured to: - According to the attribute of the first network traffic packet, filtering malicious packets in the first network traffic packet to obtain a second network traffic packet; - The TCP / IP model (123) of the first space (120) of the operating system is configured as follows: - parsing the second network traffic packet to establish communication with the first application layer of the second space of the operating system; -The first application layer (131) of the second space (130) of the operating system includes a conversion module, and the conversion model is configured as follows: -Convert the second network traffic packet into data so that the first application layer (131) can run.
2. The system according to claim 1, characterized in that The first application layer (131) of the second space (130) of the operating system further includes a control layer, wherein the control layer is configured as follows: -Receive control commands from the user side; -Sending the control command to the data layer of the network accelerator (122) of the first space (120) of the operating system, so that the data layer performs data cleaning on the second network traffic packet according to the control command.
3. The system according to claim 1, characterized in that The first application layer (131) of the second space (130) of the operating system further includes a control layer, wherein the control layer is configured as follows: -Receive control commands from the user side; - determining whether the computing resources of the data layer of the network accelerator (122) of the first space (120) of the operating system can satisfy the control command; -When the computing resources of the data layer can satisfy the control command, sending the control command to the data layer, so that the data layer performs data cleaning on the second network traffic packet according to the control command; -When the computing resources of the data layer cannot satisfy the control command, the control layer performs data cleaning on the second network traffic packet according to the control command.
4. The system according to claim 1, characterized in that -The first space (120) of the operating system is a kernel space, and the second space (130) of the operating system is a user space.
5. The system according to claim 1, characterized in that The attributes of the first network traffic packet include at least one of the following: - length, kind or status.
6. A method for improving network security, comprising: - parsing (201) the network traffic packet to obtain a first network traffic packet so that the operating system can read the content thereof; wherein the network traffic packet includes a network traffic packet sent by the controller for controlling the operation of the first device; - parsing (202) attributes of the first network traffic packet; - filtering (203) malicious packets in the first network traffic packet according to the attribute of the first network traffic packet to obtain a second network traffic packet; - parsing the second network traffic packet (204) to establish communication with the first application layer of the second space of the operating system; -Performing data conversion (205) on the second network traffic packet so that the first application layer can run.
7. The method according to claim 1, characterized in that Before parsing the second network traffic packet (204), the method further includes: -Receive control commands from the user side; -According to the control command, data cleaning is performed on the second network traffic packet.
8. The system according to claim 1, characterized in that Before parsing the second network traffic packet (204), the method further includes: -Receive control commands from the user side; - Determine whether the computing resources of the data layer can meet the control command; -When the computing resources of the data layer can satisfy the control command, sending the control command to the data layer, so that the data layer performs data cleaning on the second network traffic packet according to the control command; -When the computing resources of the data layer cannot satisfy the control command, after performing data conversion (205) on the second network traffic packet, the control layer performs data cleaning on the second network traffic packet according to the control command.
9. An electronic device, characterized in that: include: at least one memory (301) configured to store computer readable code; At least one processor (302) is configured to call the computer-readable code to execute the steps in the method according to any one of claims 6 to 8.
10. A computer-readable medium, characterized in that The computer-readable medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processor executes the steps in the method according to any one of claims 6 to 8.