Method and system for adjusting target depth of disturbance based on dynamic address hopping attack

Abstract

The application provides a dynamic address hopping attack target depth interference adjustment method and system, and belongs to the technical field of network security.The method comprises the following steps: searching for idle IP addresses of each network segment in a user network area through a network scanning tool; generating a large number of trapping hosts based on the collected idle IP addresses; performing same-side mixed deployment on the generated trapping hosts and real hosts of the user; determining the hopping range of the IP addresses of the trapping hosts, setting specific IP address segments according to network planning, setting the hopping port number range of each trapping host, and dividing different port groups according to the service type; through the deployment of the dynamic address hopping and the large number of trapping hosts, the difficulty of the attacker in identifying and attacking the real host is significantly improved, so that the attack behavior of the attacker is effectively interfered, and the overall network security is improved.

Description

Technical Field

[0001] This invention proposes a method and system for adjusting the deep interference of attack targets based on dynamic address hopping, which belongs to the field of network security technology. Background Technology

[0002] With the continuous innovation of current cyberattack methods, traditional protection methods relying on signature databases are insufficient to cope with unknown threats. Existing attack jamming techniques suffer from problems such as limited jamming methods, inability to fully obfuscate attack targets, and difficulty in uncovering potential internal threats. Therefore, there is an urgent need for an innovative deep jamming and modulation method to enhance the security of network systems. Summary of the Invention

[0003] This invention provides a method and system for adjusting the depth of interference of attack targets based on dynamic address hopping, in order to solve the problems mentioned in the background art above:

[0004] The present invention proposes a method for adjusting the depth of interference of attack targets based on dynamic address jump attacks, the method comprising:

[0005] S1. Within the user's network area, use network scanning tools to search for free IP addresses in each network segment; based on the collected free IP addresses, generate a large number of decoy hosts; deploy the generated decoy hosts and the user's real hosts on the same side.

[0006] S2. Determine the hopping range of the decoy host's IP address and set specific IP address ranges according to the network plan; set a hopping port number range for each decoy host and divide different port groups according to service type; list the service types that the decoy host can simulate; assign an initial service type combination to each decoy host according to the network environment and security requirements; determine the applications that the decoy host can simulate and assign an initial application combination to each decoy host according to the actual situation.

[0007] S3. Use fingerprint learning algorithms to identify real hosts in the network, apply unified obfuscation settings to all real hosts in the network, formulate key obfuscation strategies for specific sensitive hosts or hosts in high-risk areas, and set corresponding obfuscation cycles for different obfuscation strategies.

[0008] S4. Collect network monitoring data in real time using network monitoring tools; adaptively adjust the dynamic address hopping period based on real-time network monitoring data; dynamically optimize the active obfuscation strategy based on changes in attacker behavior patterns and network environment;

[0009] S5. Simulate a massive number of ports on the decoy host to monitor access requests to different ports in real time; when abnormal behavior is detected, record relevant attack information; the decoy host simulates multiple services and captures attacks targeting these services; simulates common applications, captures attacks targeting these applications, and records detailed attack information; establishes whitelists and unnoticed whitelists for authorized normal security operations; automatically analyzes alarms generated after whitelist filtering using preset rules and algorithms; and records the automatic analysis results in the threat database.

[0010] S6. Based on the results of the threat capture and analysis module and the network topology, locate the position of internal threat hosts in real time; determine the specific network segment and device where the threat host is located by recording the information of the threat host; network administrators take corresponding control measures on the threat host based on the information provided by the location and control module.

[0011] The present invention proposes a depth interference adjustment system for dynamic address jump attack targets, comprising:

[0012] One or more processors;

[0013] Memory, used to store one or more programs.

[0014] Wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the above.

[0015] The beneficial effects of this invention are as follows: By deploying dynamic address hopping and a massive number of decoy hosts, the difficulty for attackers to identify and attack real hosts is significantly increased, thereby effectively interfering with attacker behavior and improving overall network security; by using decoy hosts to simulate the services and applications of real hosts, attack behaviors against the network can be effectively captured, and detailed attack information can be recorded, providing data support for subsequent analysis and response; by monitoring network traffic and attack trends in real time and dynamically adjusting address hopping cycles and obfuscation strategies, the invention can flexibly adapt to changes in the network environment and threat landscape, ensuring that defense measures remain effective; by combining network topology and threat capture analysis results, the invention enables precise location of threat hosts, helping network administrators to quickly take control measures and reduce the impact of attacks; by establishing whitelists and unobtrusive whitelist mechanisms, the invention effectively filters alarms generated by normal security services, reduces false alarm rates, and improves the accuracy and reliability of security alarms. Attached Figure Description

[0016] Figure 1 This is a diagram illustrating the steps of the method described in this invention;

[0017] Figure 2 As described in this invention Figure 1 Flowchart of step S4 in the middle. Detailed Implementation

[0018] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0019] One embodiment of the present invention, such as Figure 1 As shown, a method for adjusting the depth of interference in a dynamic address hopping attack target is described, the method comprising:

[0020] S1. Within the user's network area, use network scanning tools to search for free IP addresses in each network segment; based on the collected free IP addresses, generate a large number of decoy hosts; deploy the generated decoy hosts and the user's real hosts on the same side.

[0021] S2. Determine the hopping range of the decoy host's IP address and set specific IP address ranges according to the network plan; set a hopping port number range for each decoy host and divide different port groups according to service type; list the service types that the decoy host can simulate; assign an initial service type combination to each decoy host according to the network environment and security requirements; determine the applications that the decoy host can simulate and assign an initial application combination to each decoy host according to the actual situation.

[0022] S3. Use fingerprint learning algorithms to identify real hosts in the network, apply unified obfuscation settings to all real hosts in the network, formulate key obfuscation strategies for specific sensitive hosts or hosts in high-risk areas, and set corresponding obfuscation cycles for different obfuscation strategies.

[0023] S4. Collect network monitoring data in real time using network monitoring tools; adaptively adjust the dynamic address hopping period based on real-time network monitoring data; dynamically optimize the active obfuscation strategy based on changes in attacker behavior patterns and network environment;

[0024] S5. Simulate a massive number of ports on the decoy host to monitor access requests to different ports in real time; when abnormal behavior is detected, record relevant attack information; the decoy host simulates multiple services and captures attacks targeting these services; simulates common applications, captures attacks targeting these applications, and records detailed attack information; establishes whitelists and unnoticed whitelists for authorized normal security operations; automatically analyzes alarms generated after whitelist filtering using preset rules and algorithms; and records the automatic analysis results in the threat database.

[0025] S6. Based on the results of the threat capture and analysis module and the network topology, locate the position of internal threat hosts in real time; determine the specific network segment and device where the threat host is located by recording the information of the threat host; network administrators take corresponding control measures on the threat host based on the information provided by the location and control module.

[0026] The working principle of the above technical solution is as follows: Within the user's network area, a network scanning tool is used to search for free IP addresses in each network segment; based on the collected free IP addresses, a massive number of decoy hosts are generated; each decoy host should have an independent system environment and be able to simulate some functions of a real host; the number of decoy hosts can be dynamically adjusted according to the network scale and security requirements, generally accounting for 10%-30% of the total number of IP addresses in the network; the generated decoy hosts are deployed on the same side as the user's real hosts, making it difficult for attackers to distinguish between real hosts and decoy hosts in the network; the network topology should be considered during deployment to ensure that the decoy hosts are evenly distributed across each network segment;

[0027] Determine the hopping range of the decoy host's IP address and set a specific IP address range according to the network plan; for example, in a Class C network, the hopping range can be set to 192.168.1.100 to 192.168.1.200; set a hopping port number range for each decoy host, covering common network service ports, such as 0–65535; and divide the port groups according to service type for more flexible hopping; list the service types that the decoy host can simulate, including no less than 20 common services such as SSH, TELNET, and FTP; and, based on the network environment and security requirements, assign a range of ports to each decoy host. Assign an initial service type combination to each decoy host; determine the applications that the decoy hosts can simulate, such as OA, forums, cloud storage, and no fewer than 50 common applications; and assign an initial application combination to each decoy host based on the actual situation; set an initial dynamic hopping period, generally 5-10 minutes; this period can be adaptively adjusted based on subsequent network monitoring data; formulate a dynamic address hopping strategy, including the triggering conditions and hopping order; for example, a random hopping method can be used, or based on the attack situation analysis results, priority can be given to hopping IP addresses, ports, services, or applications that are more likely to be attacked.

[0028] Fingerprint learning algorithms are used to identify real hosts in the network, including information such as MAC address, IP address, port, and service. All real hosts in the network are uniformly obfuscated, such as modifying certain bits of the MAC address or spoofing parts of the IP address. This unified obfuscation strategy reduces the possibility of attackers identifying real hosts using fixed characteristics. Targeted obfuscation strategies are developed for specific sensitive hosts or hosts in high-risk areas. For example, for servers storing important data, the frequency and complexity of obfuscation can be increased, such as using dynamic MAC address binding or frequent IP address changes. Corresponding obfuscation periods are set for different obfuscation strategies, generally 10-30 minutes; the obfuscation period can also be dynamically adjusted according to the network attack situation.

[0029] Network monitoring tools are used to collect network traffic, attack frequency, and other network monitoring data in real time. Based on the real-time network monitoring data, the dynamic address hopping cycle is adaptively adjusted. When frequent network attack activities are detected, the hopping cycle is shortened to 2-5 minutes to enhance the interference effect. When the network environment is relatively stable, the hopping cycle is appropriately extended to 10-15 minutes to reduce system resource consumption. The proactive obfuscation strategy is dynamically optimized according to changes in attacker behavior patterns and the network environment. For example, if it is found that attackers are launching concentrated attacks on a specific type of real host, the obfuscation effect on that type of host can be strengthened, and the obfuscation method and cycle can be adjusted.

[0030] The system simulates a massive number of ports on the decoy host, monitoring access requests to different ports in real time. When abnormal port scanning or malicious connections are detected, relevant attack information is recorded, including the attack source IP, attack time, and attack port. The decoy host simulates various services, capturing attacks targeting these services. For example, when a brute-force attack on the SSH service is detected, the attacker's username and password attempt count are recorded. It also simulates common applications, capturing attacks targeting these applications, such as SQL injection attacks on OA systems and XSS attacks on forum systems, and recording detailed attack information. This includes attack parameters and attack paths; for authorized vulnerability scanning, probing, and penetration testing, whitelists and undetected whitelists are established; whitelists should include legitimate security tool IP addresses, port numbers, and other information; alarms generated by normal security operations are filtered through whitelists to reduce false alarms; alarms generated after whitelist filtering are automatically analyzed using preset rules and algorithms; for example, based on factors such as attack frequency, intensity, and the importance of the target, it is determined whether the alarm is for a threat host; the automatic analysis results are recorded in the threat database, reducing the workload of analysis and judgment to almost zero;

[0031] Based on the results of the threat capture and analysis module, combined with the network topology, the location of internal threat hosts can be accurately pinpointed in real time. By recording information such as the MAC address, IP address, port, and protocol of the threat host, the specific network segment and device where the threat host is located can be determined. Based on the information provided by the location and control module, network administrators can take corresponding control measures on the threat host. For example, hosts suspected of being attacked can be isolated to prevent them from communicating with the external network; hosts confirmed to be engaging in malicious behavior can be blocked to prevent the threat from spreading further.

[0032] The effects of the above technical solution are as follows: by deploying dynamic address hopping and a large number of decoy hosts in combination, it is difficult for attackers to identify real hosts, which significantly improves the concealment and anti-attack capability of the network environment; the decoy hosts simulate real services and applications, which can actively attract and capture various types of attack behaviors, significantly improving the coverage and effectiveness of attack detection.

[0033] By employing fingerprint recognition and obfuscation strategies, the real host is disguised, increasing the difficulty for attackers to identify the real host and further enhancing network defense capabilities. Based on network monitoring data and attack behavior analysis, the system can adaptively adjust the transition period and obfuscation strategy, improving the defense system's responsiveness and intelligence to complex attack behaviors.

[0034] By dynamically adjusting the number of host traps and the jump cycle, combined with changes in the network environment and attack posture, security resources are allocated on demand, improving resource utilization efficiency. The whitelist and non-intrusive whitelist mechanisms effectively filter alarms generated by normal security services, and combined with automated analysis algorithms, the workload of manual analysis is reduced to almost zero.

[0035] By actively interfering with attack targets, dynamically changing addresses and services, and simulating a large number of fake services, the probability of attackers successfully locating and attacking real hosts is significantly reduced; combined with network topology and threat capture information, it enables precise location of threat hosts, helping network administrators to respond quickly and take effective control measures.

[0036] This method can be dynamically adjusted according to changes in network size, business needs, and security threats, and has good scalability and adaptability, making it suitable for various network environments. Through real-time monitoring, automatic analysis, and threat database recording, it improves the timeliness of security incident response and helps to quickly identify and block potential threats.

[0037] In one embodiment of the present invention, S1 includes:

[0038] S11. Select a network scanning tool and set the scanning parameters according to the network size and complexity; perform secondary verification on the idle IP addresses obtained from the scan.

[0039] S12. Use virtualization technology to build an independent system environment for each trapping host and create multiple virtual machines as trapping hosts;

[0040] S13. Based on the common functions of real hosts in the network, set up corresponding simulation functions for the decoy hosts; establish a dynamic adjustment model for the number of decoy hosts, and adjust the number of decoy hosts in real time according to changes in network size and security requirements; when the network size expands or security threats increase, automatically increase the number of decoy hosts; otherwise, decrease them.

[0041] S14. Based on the network topology, formulate a deployment location planning scheme; distribute the decoy hosts evenly across various network segments, and use technical means to deploy the decoy hosts and users' real hosts on the same side in a mixed manner;

[0042] S15. Regularly evaluate the effectiveness of hybrid deployments and check whether attackers can distinguish between real hosts and decoy hosts.

[0043] The working principle of the above technical solution is as follows: Select a network scanning tool, such as Nmap; set scanning parameters according to the network size and complexity; for example, for large enterprise networks, a faster scanning speed can be set to shorten the scanning time; for networks with high security requirements, detailed scanning options can be enabled to ensure that no idle IP addresses are missed; perform secondary verification on the idle IP addresses obtained by scanning to eliminate possible false positives; and determine whether the target IP address is truly idle by sending a small number of probe packets to it and observing whether there is a response.

[0044] Virtualization technology is used to build an independent system environment for each trap host, such as VMware or VirtualBox, and multiple virtual machines are created as trap hosts; each virtual machine should install a common operating system, such as Windows or Linux, and be configured with basic network services;

[0045] Based on the common functions of real hosts in the network, corresponding simulation functions are set for the decoy hosts; for example, simulating web servers, FTP servers, etc., so that the decoy hosts can respond to specific types of network requests, increasing their deceptiveness; establish a dynamic adjustment model for the number of decoy hosts, and adjust the number of decoy hosts in real time according to changes in network size and security needs; when the network size expands or security threats increase, the number of decoy hosts is automatically increased; otherwise, it is appropriately reduced.

[0046] Based on the network topology, develop a detailed deployment location plan; distribute the decoy hosts evenly across various network segments to ensure that attackers encounter the decoy hosts whenever they launch an attack from any location; employ technical means to deploy the decoy hosts and real users' hosts on the same side, making their locations and access methods similar in the network; for example, by configuring access control lists on network devices, the decoy hosts and real hosts can have the same access permissions.

[0047] Regularly evaluate the effectiveness of hybrid deployments to check whether attackers can distinguish between real hosts and decoy hosts; the deceptiveness and effectiveness of decoy hosts can be assessed by analyzing data such as network traffic and attack logs.

[0048] The effects of the above technical solution are as follows: By reasonably selecting and configuring network scanning tools and combining them with a secondary verification mechanism for idle IP addresses, the accuracy of the basic data for deploying the decoy hosts is ensured, and the scientific nature of the decoy network construction is improved; by using virtualization technology to build an independent system environment for each decoy host and simulating a real operating system and services, the realism and deceptiveness of the decoy host's behavior are enhanced, and the difficulty for attackers to identify it is increased.

[0049] By establishing a dynamic adjustment model for the number of decoy hosts, the system can automatically increase or decrease the number of decoy hosts according to changes in network size and security threat level, thereby improving the resilience and resource utilization of the defense system. By evenly distributing the decoy hosts across various network segments and deploying them on the same side as real hosts, attackers may encounter decoy hosts at any location, significantly improving the attack obfuscation effect and defense coverage.

[0050] By regularly evaluating the effectiveness of hybrid deployments and analyzing network traffic and attack logs, the deceptive effect of host trapping can be dynamically assessed, deployment strategies can be optimized in a timely manner, and the overall effectiveness of the defense system can be improved. By accurately identifying idle IP addresses and dynamically controlling the number of host trapping, ineffective deployments and resource waste are avoided, and system operating efficiency is improved. By simulating the functions of real hosts, host trapping creates an environment in the network that is difficult to distinguish from real hosts, significantly enhancing the stealth of network defenses and improving the ability to interfere with and mislead attackers.

[0051] In one embodiment of the present invention, S2 includes:

[0052] S21. Based on the network plan, determine the hopping range of the IP address of the decoy host, optimize the determined IP address hopping range, and adopt a dynamic allocation algorithm to adjust the hopping range in real time according to the IP address already used in the network.

[0053] S22. List common network service ports, divide the ports into different port groups according to the service type, and assign different port groups to each trap host for switching.

[0054] S23. List the service types that the decoy hosts can simulate, and assign an initial service type combination to each decoy host based on the network environment and security requirements; determine the applications that the decoy hosts can simulate, and assign an initial application combination to each decoy host based on the actual situation.

[0055] S24. Based on the network's security and performance requirements, set the initial dynamic transition period and formulate a dynamic transition strategy.

[0056] The working principle of the above technical solution is as follows: Thoroughly study the user network planning documents to understand the purpose and allocation of each network segment; determine the hopping range of the host's IP address based on the network plan to ensure that the hopping IP address does not affect the normal operation of the network; optimize the determined IP address hopping range to avoid IP address conflicts with other important network devices; and use a dynamic allocation algorithm to adjust the hopping range in real time based on the IP address usage in the network.

[0057] List common network service ports, such as HTTP (80), HTTPS (443), SSH (22), etc., and ensure that the port number jump range of the decoy host covers these ports; divide the ports into different port groups according to the service type, for example, divide the ports related to Web services into one group and the ports related to database services into another group; assign different port groups to each decoy host for jumping, increasing the difficulty for attackers to identify;

[0058] List the service types that the decoy host can simulate, including but not limited to at least 20 common services such as SSH, TELNET, FTP, and SMTP; assign an initial service type combination to each decoy host based on the network environment and security requirements; determine the applications that the decoy host can simulate, such as at least 50 common applications such as OA, forums, and cloud storage; assign an initial application combination to each decoy host based on the actual situation, so that the decoy host can simulate different types of network applications;

[0059] Based on network security and performance requirements, set an initial dynamic hopping period, typically 5-10 minutes. This period should take into account the attacker's attack frequency and the system's resource consumption. Develop a dynamic hopping strategy, including hopping trigger conditions and hopping order. For example, a random hopping method can be used, or, based on attack situation analysis results, priority can be given to hopping IP addresses, ports, services, or applications that are more likely to be attacked.

[0060] The effects of the above technical solution are as follows: By conducting in-depth analysis of user network planning, the hopping range is accurately defined, and combined with dynamic allocation algorithms for real-time adjustment, IP address conflicts are effectively avoided, ensuring that hopping operations do not affect the normal operation of the network, and improving the stability and security of the hopping mechanism; by dividing the service port into multiple port groups and assigning different groups to different decoy hosts for hopping, it is difficult for attackers to lock the real target through port characteristics, significantly enhancing the confusion and defense capabilities of the network environment;

[0061] It supports simulation combinations of no less than 20 service types and no less than 50 common applications, making the decoy host more closely resemble the real host in terms of functionality, greatly enhancing its deceptiveness and attack attractiveness, and improving attack capture efficiency; it formulates dynamic jumping strategies based on the attack situation, supporting multiple methods such as random jumping and priority jumping, enabling the system to flexibly adjust the defense rhythm according to the actual security threat, and improving the intelligence and responsiveness of the overall defense mechanism.

[0062] By setting an initial jump cycle (5-10 minutes) appropriately and dynamically adjusting it according to the network attack situation, resource waste is avoided, and system performance and stability are taken into account while ensuring security. Through a multi-dimensional jump mechanism of IP, port, service, and application, a highly dynamic and frequently changing network environment is constructed, which significantly increases the attacker's uncertainty about the network structure and target location, and improves the proactive defense capability.

[0063] In one embodiment of the present invention, step S21 includes:

[0064] Acquire various planning documents related to the user's network, classify and organize these documents, create a document index, analyze the collected documents to obtain the purpose and allocation of each network segment, and annotate and extract key information related to IP address allocation during the document interpretation process.

[0065] Based on the purpose and allocation of each network segment in the network planning document, network segments that can be used to trap host IP address hopping are initially selected; combined with the network topology diagram, the connection relationship and communication path between different network segments are analyzed; network segments located at the network edge or relatively independent are selected as the range for trapping host IP address hopping.

[0066] Within the defined initial transition range, a certain safety buffer area is reserved; the transition range is divided into multiple sub-intervals, and a certain number of unassigned IP addresses are reserved between each sub-interval;

[0067] Collect IP address information of all important network devices in the network and establish a detailed IP address database of important devices;

[0068] Based on an intelligent IP address conflict detection algorithm, a comprehensive scan is performed on the determined initial transition range; after the intelligent conflict detection algorithm completes the detection, manual review and verification are conducted.

[0069] The working principle of the above technical solution is as follows: Acquire various planning documents related to the user's network, including but not limited to network topology diagrams, IP address allocation tables, and network functional partition descriptions; classify and organize the planning documents, establish a document index directory, and analyze the collected documents to obtain the purpose and allocation status of each network segment; for example, clarify which network segments are used for internal office networks, which for server clusters, and which for connections to external networks; simultaneously, analyze the access control policies and traffic flow between each network segment, and draw detailed network traffic diagrams to provide comprehensive network environment information for subsequently determining the IP address hopping range; during the document interpretation process, mark and extract key information related to IP address allocation; record the starting IP address, ending IP address, subnet mask, and other information of each network segment, and analyze the allocated and unallocated IP addresses in these network segments; create a detailed IP address allocation table to intuitively display the IP address usage status of each network segment;

[0070] Based on the purpose and allocation of each network segment in the network planning document, a preliminary selection of network segments suitable for capturing host IP address hopping is made. Segments used for critical business systems, core network equipment, or those with extremely high network stability requirements are excluded to ensure that the hopped IP address will not affect the normal operation of the network. For example, avoid setting the hopped IP address of the captured host in the network segment where the database server is located to prevent interference with normal database access. Analyze the connection relationships and communication paths between different network segments using the network topology diagram. Select network segments located at the network edge or relatively independent as the hopping range for the captured host's IP address to reduce the impact of the hopping operation on the core network. Simultaneously, consider the routing policies and switch configurations in the network to ensure that the hopped IP address can be correctly routed and switched.

[0071] Within the defined initial transition range, a certain safety buffer area is reserved; the transition range is divided into multiple sub-intervals, and a certain number of unassigned IP addresses are reserved between each sub-interval; this provides room for subsequent network expansion and adjustment, while avoiding IP address conflicts or network failures caused by transition operations; for example, a Class C network segment is divided into 3-4 sub-intervals, and 10-20 unassigned IP addresses are reserved between each sub-interval;

[0072] Collect IP address information for all important network devices, including routers, switches, firewalls, and servers; establish a detailed IP address database for important devices, recording information such as IP address, MAC address, device type, and network segment to which each device belongs; and regularly update this database to ensure the accuracy and timeliness of the information.

[0073] Based on an intelligent IP address conflict detection algorithm, a comprehensive scan is performed on the determined initial hopping range. This algorithm should be able to quickly and accurately detect whether there are any conflicts with the IP addresses of important devices within the hopping range. For example, a hash table-based conflict detection algorithm can be used, storing the IP addresses of important devices in a hash table, and then performing hash calculations on each IP address within the hopping range to determine if a conflict exists. After the intelligent conflict detection algorithm completes its detection, manual review and verification are performed. The detection results are manually checked to ensure that no potential IP address conflicts are missed. Simultaneously, some special cases are analyzed and judged, such as devices that may use dynamic IP address allocation methods, requiring further confirmation as to whether they will conflict with the hopping IP address under specific circumstances.

[0074] The effects of the above technical solution are as follows: By comprehensively analyzing the network planning document and extracting key information, the selection of the hopping range is ensured to be based on a real and complete network structure, which significantly improves the scientificity and feasibility of the hopping mechanism; by establishing an important device IP address database and adopting an intelligent conflict detection algorithm, combined with a manual review mechanism, the IP address conflict problem that may occur during the hopping process is effectively avoided, which significantly enhances the ability of the hopping operation to ensure the stable operation of the network.

[0075] Creating detailed IP address allocation tables and network traffic graphs improves the transparency of network resource usage and provides reliable data support for subsequent security policy formulation and dynamic adjustment. Reserving security buffer zones within the transition range and dividing them into multiple sub-intervals provides room for future network expansion and policy adjustments, significantly enhancing the system's scalability and flexibility.

[0076] By excluding critical business network segments and prioritizing network edge or relatively independent network segments as the hopping range, the risk of hopping operations impacting the core network and critical business systems is effectively reduced. The introduction of intelligent algorithms such as hash table collision detection, combined with dynamic hopping strategies, significantly improves the automation level and intelligent response capability of the network defense system. By establishing a document index directory and regularly updating the IP database of important devices, the maintainability and sustainable operation capability of the network defense system are improved.

[0077] In one embodiment of the present invention, S3 includes:

[0078] S31. Automatically learn the characteristics of real hosts in the network through a fingerprint recognition algorithm based on machine learning, perform fingerprint recognition on real hosts in the network, and store the recognition results in the real host fingerprint database.

[0079] S32. Implement unified obfuscation settings for all real hosts in the network, periodically evaluate the effectiveness of the unified obfuscation strategy, and check whether attackers can bypass the obfuscation settings to identify real hosts.

[0080] S33. Identify sensitive hosts in the network and develop targeted obfuscation strategies for sensitive hosts and hosts in high-risk areas;

[0081] S34. Set corresponding obfuscation periods for different obfuscation strategies. When frequent network attack activities are detected, shorten the obfuscation period; when the network environment is stable, extend the obfuscation period.

[0082] The working principle of the above technical solution is as follows: the fingerprint recognition algorithm based on machine learning automatically learns the characteristics of real hosts in the network, including MAC address, IP address, port, service and other information; performs fingerprint recognition on real hosts in the network and stores the recognition results in the real host fingerprint database; the fingerprint database should be updated regularly to adapt to changes in real hosts in the network.

[0083] Apply uniform obfuscation settings to all real hosts in the network, such as modifying certain bits of the MAC address or spoofing some fields of the IP address; the obfuscation settings should have a certain degree of randomness and complexity to reduce the possibility of attackers identifying real hosts through fixed characteristics; regularly evaluate the implementation effect of the uniform obfuscation strategy to check whether attackers can break through the obfuscation settings to identify real hosts; the effectiveness of the obfuscation strategy can be evaluated through simulated attack tests.

[0084] Identify sensitive hosts in the network, such as servers storing important data and core network devices, as well as high-risk areas, such as network segments connected to external networks; develop targeted obfuscation strategies for sensitive hosts and hosts in high-risk areas; for example, use more complex obfuscation methods for sensitive hosts, such as dynamic MAC address binding and frequent IP address changes; increase the frequency of obfuscation for hosts in high-risk areas;

[0085] Set corresponding obfuscation periods for different obfuscation strategies. The obfuscation period can be dynamically adjusted according to the network attack situation. When frequent network attack activities are detected, shorten the obfuscation period; when the network environment is relatively stable, appropriately extend the obfuscation period.

[0086] The above technical solution achieves the following effects: by using a machine learning-based fingerprinting algorithm to learn the features of real hosts and establishing a dynamically updated real host fingerprint database, it significantly improves the accuracy of host feature identification and the perception capability of the defense system, and enhances the concealment of real hosts in the network; by implementing unified obfuscation settings on real hosts, such as modifying some fields of the MAC address and disguising the IP address, combined with a certain degree of randomness and complexity, it greatly increases the difficulty for attackers to identify real hosts through static features.

[0087] Targeted obfuscation strategies were developed for sensitive hosts and high-risk areas, employing more complex and frequent obfuscation methods to effectively enhance the security protection level of critical assets and prevent key targets from becoming attack entry points. By setting up a dynamically adjustable obfuscation cycle mechanism, the obfuscation strategy can be flexibly changed according to the network attack situation, strengthening defense when attacks are frequent and reducing resource consumption when the situation is stable, significantly improving the intelligence and adaptability of the system.

[0088] Regularly evaluate the effectiveness of obfuscation strategies and conduct simulated attack tests to ensure that the obfuscation strategies have good protective effects in real-world environments, thereby improving the scientific nature and controllability of the defense system. By dynamically changing host characteristics and frequently updating fingerprint information, the attacker's ability to track and fingerprint target hosts over a long period of time is effectively disrupted, significantly reducing the risk of continuous penetration. Differentiated settings for obfuscation strategies and cycles enable security resources to prioritize high-risk areas and sensitive hosts, avoiding resource waste and improving the overall resource utilization of the network defense system.

[0089] In one embodiment of the present invention, S34 includes:

[0090] Acquire comprehensive data related to cyberattacks; utilize machine learning and data analysis algorithms to perform real-time analysis of the collected attack data;

[0091] By introducing external threat intelligence sources and using a threat intelligence platform to correlate and analyze this external information with internal monitoring data, we can obtain the latest attack trends, the tools and techniques used by attackers, and other information.

[0092] Different attack frequency thresholds are set, and the obfuscation cycle is dynamically adjusted based on the comparison between the real-time monitored attack frequency and the threshold.

[0093] Develop differentiated obfuscation cycle adjustment strategies for different types of attacks; adjust the obfuscation cycle in advance based on attack trend prediction results from real-time situational analysis.

[0094] During the adjustment of the obfuscation cycle, the system's resource usage is monitored in real time. Real-time data on system resources is obtained through system monitoring tools. A resource usage model is established to analyze the consumption of system resources under different obfuscation cycles and to obtain the relationship between resource consumption and obfuscation cycle.

[0095] Based on the monitoring results of system resources and security requirements, seek the optimal balance between security protection and system resource consumption; formulate dynamic resource allocation strategies and flexibly adjust resource allocation according to network attack trends and system resource usage.

[0096] The established obfuscation cycle adjustment strategy is deployed to relevant hosts and devices in the network using automated scripts or configuration management tools. After the strategy is implemented, the security protection effect and system resource usage after the obfuscation cycle adjustment are monitored in real time. Relevant data is collected using security monitoring tools and system monitoring tools and compared with the data before the adjustment. If the effect after the adjustment is found to be unsatisfactory, the problem is reported in a timely manner, and the adjustment strategy is optimized and improved.

[0097] Based on real-time monitoring and feedback results, the confusion cycle adjustment strategy is continuously optimized and iterated.

[0098] The working principle of the above technical solution is as follows: Acquire comprehensive network attack-related data; perform real-time analysis of the collected attack data using machine learning and data analysis algorithms; including: using time series analysis methods to predict the trend of attack frequency changes over time and identify the periodic patterns of attack activities; simultaneously, using clustering analysis algorithms to classify different types of attacks, understanding the distribution and interrelationships of various attack types; and constructing an attack situation model to transform complex attack data into intuitive situation indicators, such as attack intensity index and attack risk level, providing a quantitative basis for subsequent obfuscation cycle adjustments.

[0099] Introduce external threat intelligence sources, such as threat reports released by security vendors and attack information shared by industry security organizations; through the threat intelligence platform, correlate and analyze this external information with internal monitoring data to obtain the latest attack trends, the tools and techniques used by attackers, and other information; for example, if a new attack method targeting a specific operating system or application is discovered, and this method may pose a threat to the network, the obfuscation strategy and cycle can be adjusted in advance to enhance defense capabilities.

[0100] Different attack frequency thresholds are set, and the obfuscation period is dynamically adjusted based on the comparison between the real-time monitored attack frequency and the threshold. For example, when the attack frequency is below the low threshold, the network environment is considered relatively safe, and the obfuscation period is extended to a longer time, such as 30 minutes to 1 hour, to reduce system resource consumption. When the attack frequency is between the low and high thresholds, the current obfuscation period remains unchanged. When the attack frequency exceeds the high threshold, it indicates that the network is under frequent attacks, and the obfuscation period is immediately shortened to a shorter time, such as 1 to 5 minutes, to enhance the interference against attackers.

[0101] Differentiated obfuscation cycle adjustment strategies should be developed for different types of attacks. For common, low-risk attack types, such as occasional port scans, the obfuscation cycle adjustment range can be appropriately widened to maintain a relatively stable obfuscation rhythm. For high-risk attack types, such as DDoS attacks and zero-day exploit attacks, once such attacks are detected, the obfuscation cycle should be immediately shortened to the shortest possible time, and the attack situation should be continuously monitored, with the cycle dynamically adjusted according to the attack's development. For example, in the early stages of a DDoS attack, the obfuscation cycle can be shortened to 1 minute, making it difficult for attackers to accurately locate targets by frequently changing the network characteristics of hosts. As the attack subsides, the obfuscation cycle can be gradually extended, while maintaining a certain level of vigilance. The obfuscation cycle can be adjusted in advance based on the attack trend prediction results in real-time situation analysis. If the attack frequency is predicted to increase in the future, such as when historical data and model analysis show that attack activity is more frequent during specific time periods each week, the obfuscation cycle can be shortened in advance before that period arrives to prepare for defense. Conversely, if the attack frequency is predicted to decrease, the obfuscation cycle can be appropriately extended to optimize system resource utilization.

[0102] During the adjustment of the obfuscation cycle, the system's resource usage is monitored in real time, including CPU utilization, memory usage, and network bandwidth usage; real-time data of system resources is obtained through system monitoring tools; a resource usage model is established to analyze the consumption of system resources under different obfuscation cycles and to obtain the relationship between resource consumption and obfuscation cycle.

[0103] Based on system resource monitoring results and security requirements, an optimal balance should be sought between security protection and system resource consumption. When system resources are relatively abundant, priority should be given to enhancing security protection, appropriately shortening the obfuscation cycle, and adopting more complex obfuscation strategies. When system resources are scarce, the obfuscation cycle should be appropriately extended to reduce resource consumption while ensuring basic security protection. For example, during peak network periods, system resources are mainly used to ensure normal business traffic, so the obfuscation cycle can be appropriately extended to avoid affecting business performance due to excessive resource consumption by obfuscation operations. During off-peak network periods, system resources are relatively idle, so the obfuscation cycle can be shortened and security protection strengthened. A dynamic resource allocation strategy should be formulated to flexibly adjust resource allocation according to the network attack situation and system resource usage. For example, when a high-risk attack is detected, more system resources should be allocated to obfuscation operations to shorten the obfuscation cycle and enhance defense capabilities. At the same time, the resource consumption of other non-critical businesses should be reduced to ensure that obfuscation operations can be implemented smoothly. When the attack situation subsides, resource allocation should be readjusted to restore normal business operations.

[0104] The established obfuscation cycle adjustment strategy is deployed to relevant hosts and devices in the network using automated scripts or configuration management tools. Before deployment, thorough testing and verification are conducted to ensure the strategy's implementation does not impact normal network operation. For example, different attack scenarios and system resource conditions are simulated in a test environment to check the strategy's effectiveness and system stability. After implementation, the security protection effect and system resource usage after the obfuscation cycle adjustment are monitored in real time. Relevant data is collected using security monitoring and system monitoring tools and compared with data before adjustment. If the adjusted effect is unsatisfactory, such as attackers still being able to bypass obfuscation settings to identify the real host, or excessive system resource consumption affecting business performance, the problem is promptly reported, and the adjustment strategy is optimized and improved.

[0105] Based on real-time monitoring and feedback results, the obfuscation cycle adjustment strategy is continuously optimized and iterated; lessons learned are constantly summarized to adjust attack posture monitoring indicators, cycle adjustment rules, and resource balancing strategies to improve the adaptability and effectiveness of the strategy; at the same time, attention is paid to the latest technologies and development trends in the industry, and new methods and tools are introduced to continuously improve the network security protection level.

[0106] The effects of the above technical solutions are as follows: By introducing machine learning, time series analysis, and clustering algorithms, intelligent analysis of attack frequency, type, and trends is performed, significantly improving the scientificity and accuracy of obfuscation cycle adjustments and making defense strategies more aligned with actual attack situations; By combining external threat intelligence with internal monitoring data for correlation analysis, the system can detect potential threats in advance and achieve proactive adjustments to obfuscation strategies, significantly enhancing the dynamic response and adaptability of the defense system.

[0107] Differentiated obfuscation cycle adjustment strategies are developed for different attack types, enabling defense resources to focus on high-risk attacks and significantly improving security protection strength and response efficiency in critical scenarios. By monitoring system resource usage in real time and combining it with resource consumption models, the obfuscation cycle and strategies are dynamically adjusted to avoid resource overload while ensuring security, thus significantly improving system stability and resource utilization.

[0108] By deploying obfuscation strategies through automated scripts or configuration management tools, and combining them with feedback mechanisms to achieve continuous optimization of the strategies, the automation, intelligence, and operational efficiency of the defense system have been significantly improved. By dynamically adjusting the obfuscation cycle, especially shortening the cycle in scenarios with frequent attacks or high risks, and frequently changing host characteristics, the possibility of attackers identifying real hosts has been significantly reduced, enhancing the network's stealth and anti-attack capabilities.

[0109] Testing and verification, as well as effect comparison and analysis, were conducted before and after the strategy was deployed. The strategy was continuously optimized based on feedback data, which improved the verifiability, traceability, and continuous improvement capability of security protection measures. By predicting attack trends and analyzing periodic patterns, obfuscation strategies were deployed in advance, enabling the defense system to shift from passive response to active defense, which significantly improved the overall security and controllability of the cyberspace.

[0110] One embodiment of the present invention, such as Figure 2 As shown, S4 includes:

[0111] S41. Collect network monitoring data in real time using network monitoring tools; store and manage the collected network monitoring data based on the monitoring data storage system;

[0112] S42. Based on the attack situation analysis algorithm, analyze the network monitoring data collected in real time and judge the frequency of network attack activities.

[0113] S43. Based on the attack situation analysis results, adaptively adjust the dynamic address hopping period; when frequent network attack activities are detected, shorten the hopping period to 2 to 5 minutes, and when the network environment is stable, extend the hopping period to 10 to 15 minutes.

[0114] S44. By analyzing network monitoring data, obtain the attacker's behavior patterns, and dynamically optimize the active obfuscation strategy based on the attacker's behavior patterns and changes in the network environment.

[0115] The working principle of the above technical solution is as follows: network monitoring data such as network traffic and attack frequency are collected in real time through network monitoring tools such as Wireshark and Snort; the collected network monitoring data is stored and managed based on the monitoring data storage system; the storage system should have efficient data retrieval and analysis capabilities to facilitate subsequent analysis of network attack trends;

[0116] Based on the attack situation analysis algorithm, the network monitoring data collected in real time is analyzed to determine the frequency of network attack activities; the algorithm should take into account factors such as the frequency, intensity, and target of the attack.

[0117] Based on the attack situation analysis results, the dynamic address hopping period is adaptively adjusted; when frequent network attack activities are detected, the hopping period is shortened to 2 to 5 minutes to enhance the interference effect; when the network environment is relatively stable, the hopping period is appropriately extended to 10 to 15 minutes to reduce system resource consumption.

[0118] By analyzing network monitoring data, attacker behavior patterns can be obtained, such as attack timing patterns and target selection preferences. Based on changes in attacker behavior patterns and the network environment, proactive obfuscation strategies can be dynamically optimized. For example, if it is discovered that attackers are launching concentrated attacks on specific types of real hosts, the obfuscation efforts for that type of host can be strengthened, and the obfuscation methods and cycles can be adjusted.

[0119] The effects of the above technical solution are as follows: by deploying network monitoring tools such as Wireshark and Snort, real-time collection of network traffic and attack frequency is achieved, significantly improving the ability to perceive network attack activities and enhancing the control of the security situation; based on a data storage system with efficient retrieval and analysis capabilities, the monitoring data is uniformly stored and managed, improving the availability of data and the efficiency of subsequent analysis, and providing solid data support for security decisions.

[0120] By comprehensively evaluating multiple factors such as attack frequency, intensity, and target through attack situation analysis algorithms, the accuracy and intelligence of network attack situation identification are significantly enhanced, and the scientific nature of defense response is improved. The address hopping cycle is automatically adjusted according to the attack situation, shortening the cycle to enhance interference when attacks are frequent and extending the cycle to save resources when the situation is stable, which significantly improves the adaptability and flexibility of the network defense system.

[0121] By analyzing attacker behavior patterns, such as attack timing and target preferences, the obfuscation strategy is dynamically optimized, making the defense measures more closely match the attack characteristics and significantly enhancing the ability to identify and interfere with specific attack behaviors. The obfuscation method and cycle are adjusted according to the type of attack target, achieving precise protection for key attack targets and improving the targeting and protection effectiveness of the obfuscation strategy.

[0122] By dynamically adjusting the jump cycle and obfuscation strategy, excessive defensive operations are avoided when security threats are low, significantly improving the utilization efficiency of system resources and ensuring the stable operation of business systems. Combined with real-time monitoring, intelligent analysis and dynamic strategy adjustment, a shift from passive defense to proactive defense has been achieved, significantly improving the intelligence, foresight and combat response capabilities of the network defense system.

[0123] In one embodiment of the present invention, S41 includes:

[0124] Network monitoring tools are used to capture data packets in the network in real time, obtain detailed information about network traffic, and analyze the obtained information to obtain network traffic distribution, communication patterns, and potential security threats.

[0125] Integrate system logs from various devices in the network; collect alarm information from security devices; and transmit the collected network monitoring data to the storage system via a data transmission channel.

[0126] Before data storage, the collected raw network monitoring data is preprocessed. A distributed storage architecture is adopted to distribute the data across multiple nodes. In conjunction with database technology, different types of data are classified, stored and managed.

[0127] The working principle of the above technical solution is as follows: use network monitoring tools to capture data packets in the network in real time, obtain detailed information about network traffic, including source IP address, destination IP address, port number, protocol type, data packet size, transmission time, etc.; analyze the obtained detailed information to obtain network traffic distribution, communication patterns and potential security threats; for example, abnormally high traffic transmission may indicate a distributed denial-of-service (DDoS) attack, while frequent connections to specific ports may indicate the presence of malware communication;

[0128] This system integrates system logs from various network devices (such as servers, routers, and firewalls). System logs record device operating status, event information, and error alarms, providing crucial contextual information for network attack analysis. For example, server login logs can help identify unauthorized access attempts, and firewall logs can display blocked attack traffic and its source. By collecting and analyzing system logs, a more comprehensive understanding of the network attack path and its impact can be achieved. It also collects alarm information from security devices such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). These devices can monitor abnormal behavior in the network in real time and generate alarms based on preset rules. Integrating and analyzing alarm data from different security devices allows for the timely detection of potential network attack activities and the assessment of their severity. For example, when multiple security devices simultaneously issue alarms about the same attack source, it can be determined that the attack may be highly threatening and requires immediate countermeasures. Finally, the collected network monitoring data is transmitted to the storage system via a data transmission channel.

[0129] Before data storage, the collected raw network monitoring data is preprocessed. A distributed storage architecture, such as the Hadoop Distributed File System (HDFS) or Ceph, is used to distribute the data across multiple nodes. Database technologies, such as relational databases (MySQL, Oracle) or non-relational databases (MongoDB, Redis), are used to classify, store, and manage different types of data. For example, structured system log data is stored in a relational database for complex queries and correlation analysis, while semi-structured or unstructured network traffic data is stored in a non-relational database to improve data storage and retrieval efficiency.

[0130] The above technical solution achieves the following effects: by capturing network data packets and extracting detailed information such as source IP, destination IP, port number, protocol type, and data packet size, it significantly enhances the fine-grained perception of network behavior and improves the accuracy of attack identification; by integrating system logs from devices such as servers, routers, and firewalls, it provides rich contextual information for attack analysis, significantly improving the accuracy of attack path tracing and impact scope judgment.

[0131] By centrally collecting alarm information from security devices such as firewalls, IDS, and IPS, and performing multi-source data correlation analysis, potential attack behaviors can be identified more quickly and accurately, improving the response capability to high-threat attacks. The use of distributed storage architecture (such as HDFS and Ceph) to distribute the massive network monitoring data and combining relational and non-relational databases to classify and manage different types of data significantly improves the system's data processing capabilities and scalability, meeting the storage and analysis needs of large-scale network environments.

[0132] Preprocessing operations such as cleaning and format conversion are performed before data storage to ensure data quality, providing a high-quality, structured, and analyzable data foundation for subsequent security analysis and situational awareness; multi-dimensional integrated analysis of traffic data, log data, and security alerts enhances the ability to analyze the correlation between different security events, which helps to discover complex attack chains and covert attack behaviors.

[0133] By using a multi-source data fusion and cross-validation mechanism, the risk of misjudgment caused by a single data source is effectively reduced, and the accuracy and reliability of security event identification are improved. This technical solution constructs a complete closed-loop process from data collection, transmission, storage to analysis, providing solid data support for subsequent advanced security capabilities such as AI-based security situation awareness, threat hunting, and automated response.

[0134] In one embodiment of the present invention, S44 includes:

[0135] By using time series analysis algorithms to analyze network monitoring data over long periods, we can uncover the temporal distribution patterns of attack behavior within a day, a week, or even a month; and analyze the duration of attack behavior to determine whether it is a short-term, sudden attack or a long-term, continuous infiltration.

[0136] The system analyzes the number and frequency of attacks by attackers against different types of hosts and network services, and uses correlation analysis algorithms to identify the key characteristics of attack targets that attackers are focusing on.

[0137] Analyze the attack payloads and protocol characteristics in network monitoring data to identify the attack methods and tools used by attackers; match the detected attack behaviors with known attack methods using an attack signature database to determine the attack type;

[0138] Real-time monitoring of changes in network topology; obtaining status information and connection relationships of network devices through network management protocols; and constructing a dynamic network topology map.

[0139] Real-time monitoring and analysis of network traffic is performed to extract characteristic parameters of the traffic. Machine learning algorithms are used to identify normal and abnormal patterns of network traffic. When abnormal changes occur in network traffic, the causes are analyzed to determine whether they are related to attacker behavior, and the active obfuscation strategy is adjusted based on the analysis results.

[0140] Assess the overall security posture of the network; use a security posture assessment model to quantify and analyze various security indicators to obtain the network security posture level; and dynamically adjust the strength and scope of the active obfuscation strategy based on changes in the security posture level.

[0141] Based on the attacker's behavior patterns, develop personalized proactive obfuscation strategies; adapt these strategies to changes in the network environment.

[0142] The working principle of the above technical solution is as follows: By using time series analysis algorithms to analyze network monitoring data over a long period of time, the time distribution patterns of attack behavior within a day, a week, or even a month can be discovered. For example, it can be found that some attackers launch attacks more frequently during specific time periods on weekdays (such as 10:00 to 11:00 AM) or are more active at night on weekends. The duration of the attack behavior can be analyzed to determine whether it is a short-term sudden attack or a long-term continuous infiltration, providing a time dimension basis for the subsequent development of targeted obfuscation strategies.

[0143] The study analyzes the number and frequency of attacks by attackers against different types of hosts and network services. Through correlation analysis algorithms, it identifies the key characteristics of attack targets that attackers focus on. For example, it discovers that attackers tend to attack hosts running specific operating systems (such as Windows Server 2019) or specific applications (such as the database management system MySQL). At the same time, it analyzes the attackers' attack preferences at different network layers (such as network layer, transport layer, and application layer) to understand their attack paths and target selection strategies in the network.

[0144] Analyze the attack payloads and protocol characteristics in network monitoring data to identify the attack methods and tools used by attackers; match the detected attack behaviors with known attack methods through an attack signature database to determine the attack type, such as SQL injection attacks, DDoS attacks, and malware infections; at the same time, analyze the versions and variants of the tools used by attackers to understand their technological evolution trends and provide technical references for developing targeted obfuscation strategies.

[0145] Real-time monitoring of network topology changes, including the access of new devices, the shutdown of old devices, and the addition or removal of network links; acquisition of network device status information and connection relationships through network management protocols (such as SNMP) to construct a dynamic network topology map; analysis of the impact of network topology changes on attacker behavior and proactive obfuscation strategies. For example, the access of new devices may become new targets for attackers, requiring timely adjustments to obfuscation strategies to protect the devices; adjustments to network links may change attack paths, requiring a reassessment of the effectiveness of obfuscation strategies.

[0146] Real-time monitoring and analysis of network traffic is performed to extract characteristic parameters such as traffic size, traffic direction, protocol distribution, and application type. Machine learning algorithms are used to identify normal and abnormal patterns in network traffic. When abnormal changes occur in network traffic, such as a sudden increase in traffic or the appearance of traffic with unknown protocols, the possible causes are analyzed to determine whether they are related to attacker behavior, and proactive obfuscation strategies are adjusted based on the analysis results. For example, if a large amount of abnormal traffic is detected, it may be a precursor to a DDoS attack, and obfuscation measures against such attacks can be strengthened in advance.

[0147] Taking into account factors such as attack frequency, attack intensity, and vulnerability status in network monitoring data, the overall security posture of the network is assessed. Security posture assessment models, such as the Analytic Hierarchy Process (AHP) or fuzzy comprehensive evaluation method, are used to quantify and analyze various security indicators to derive the network's security posture level. Based on changes in the security posture level, the intensity and scope of proactive obfuscation strategies are dynamically adjusted. For example, when the network is at a high security risk level, the implementation of obfuscation strategies is strengthened, increasing the frequency and complexity of obfuscation; when the network security posture improves, the intensity of obfuscation strategies is appropriately reduced to decrease system resource consumption.

[0148] Based on attacker behavior patterns, develop personalized proactive obfuscation strategies. For example, if attackers are found to be launching concentrated attacks on specific types of real hosts, the obfuscation efforts for those hosts can be strengthened by combining multiple obfuscation techniques, such as dynamic IP address allocation, port switching, and service masquerading, making it difficult for attackers to accurately identify the location and characteristics of the real hosts. Simultaneously, based on the attackers' attack timing patterns, strengthen obfuscation measures during peak attack periods to improve defense effectiveness. Adaptively adjust proactive obfuscation strategies according to changes in the network environment. When network topology changes, promptly update network device information and connection relationships in the obfuscation strategy to ensure its effectiveness. When network traffic characteristics undergo abnormal changes, adjust the focus of the obfuscation strategy according to the type of anomaly. For example, if a large amount of port scanning traffic is detected, port information obfuscation can be strengthened by using random port mapping or port hiding techniques, making it difficult for attackers to obtain the true port open status.

[0149] The effects of the above technical solutions are as follows: By using time series analysis, correlation analysis, traffic feature extraction and other methods, attack patterns are comprehensively explored from multiple dimensions such as time, target, behavior and technology, which significantly enhances the depth of understanding and identification ability of attacker behavior patterns; Based on the analysis of attack target characteristics, attack paths and attack tools, personalized obfuscation strategies are formulated to make defense measures more closely match the characteristics of attack behavior, which significantly improves the defense effect and resource utilization efficiency of obfuscation strategies.

[0150] By introducing machine learning algorithms and security situation assessment models (such as AHP and fuzzy comprehensive evaluation method), we can achieve quantitative analysis of network attack behavior and security status, and promote the transformation of defense strategies from experience-driven to data-driven and intelligent-driven. By monitoring changes in network topology and traffic characteristics in real time, we can dynamically adjust obfuscation strategies to ensure that the defense mechanism still has good adaptability and effectiveness in the face of scenarios such as new device access and network reconstruction.

[0151] By analyzing attack timing patterns and abnormal traffic patterns, early detection of attack precursors and deployment of targeted obfuscation measures significantly enhance the foresight and proactivity of network defense, enabling a shift from "passive response" to "proactive defense." Combining attack signature databases with attack payload matching analysis accurately identifies attack types and the evolution trend of attack tools, providing technical support for formulating precise defense strategies and effectively reducing false positive and false negative rates.

[0152] The strength and scope of the obfuscation strategy are dynamically adjusted according to the security situation level. Obfuscation measures are strengthened during high-risk periods or areas, while resource consumption is appropriately reduced during low-risk periods, significantly improving the rational utilization of system resources. Through multi-source data fusion analysis, full-link perception and multi-dimensional response to attack behaviors are achieved, enhancing the collaborative combat capability and overall linkage between various modules of the defense system. By constructing a dynamic model and adaptive adjustment mechanism, the obfuscation strategy has good scalability and continuous optimization capabilities, making it easy to cope with changes in new attack methods and complex network environments.

[0153] In one embodiment of the present invention, step S5 includes:

[0154] S51. Simulate a large number of ports on the decoy host and monitor access requests for different ports in real time; when abnormal behavior is detected, record relevant attack information; the decoy host simulates multiple services and captures attacks targeting these services.

[0155] S52. Simulate common applications, capture attacks targeting these applications, record detailed attack information, and establish whitelists and unnoticed whitelists for authorized normal security operations.

[0156] S53. By filtering through a whitelist, alarms generated by normal security services are excluded. When a network attack alarm is received, first check whether the attack source is in the whitelist. If it is, ignore the alarm.

[0157] S54. For alarms generated after whitelist filtering, use preset rules and algorithms to automatically analyze them; determine whether they are threat host alarms; and record the automatic analysis results in the threat database.

[0158] The working principle of the above technical solution is as follows: a massive number of ports are simulated on the decoy host to monitor access requests for different ports in real time; when abnormal port scanning, malicious connections, or other behaviors are detected, relevant attack information is recorded, including the attack source IP, attack time, and attack port; the decoy host simulates multiple services to capture attacks targeting these services; for example, when a brute-force attack on the SSH service is detected, information such as the attacker's username and the number of password attempts is recorded.

[0159] Simulate common applications to capture attacks targeting those applications, such as SQL injection attacks on OA systems and XSS attacks on forum systems; and record detailed attack information, including attack parameters and attack paths; for authorized vulnerability scanning, probing, penetration testing, and other normal security operations, establish whitelists and unnoticed whitelists; the whitelists should include legitimate security tool IP addresses, port numbers, and other information;

[0160] By filtering through a whitelist, alarms generated by normal security operations are excluded, reducing false alarms; when a network attack alarm is received, the attack source is first checked to see if it is in the whitelist, and if so, the alarm is ignored.

[0161] Alarms generated after whitelist filtering are automatically assessed using preset rules and algorithms. For example, based on factors such as attack frequency, intensity, and the importance of the target, it is determined whether the alarm is for a threatening host. The automatic assessment results are recorded in the threat database, reducing the workload of analysis and assessment to almost zero. The threat database should have data query, statistics, and analysis functions so that network administrators can understand the network threat situation in a timely manner.

[0162] The above technical solution achieves the following effects: by mimicking a massive number of ports and simulating various services and applications on the decoy host, it significantly improves the ability to capture various types of attacks, covering a wide range of attack types from basic service attacks to complex application layer attacks, thereby enhancing the breadth and depth of network defense; it also provides detailed recording of attack behaviors, including the attack source IP, attack time, attack port, attempted usernames and passwords, attack parameters and paths, significantly enhancing the traceability and analysis capabilities of attack behaviors, and providing detailed data support for subsequent threat assessment.

[0163] By establishing whitelist and non-intrusive whitelist mechanisms, alerts generated by legitimate security operations (such as vulnerability scanning and penetration testing) are effectively filtered, greatly reducing the number of invalid alerts and improving the credibility and response efficiency of alerts. The filtered alerts are automatically analyzed, and a comprehensive judgment is made by combining multiple dimensions such as attack frequency, intensity, and target importance, which reduces the workload of manual analysis to almost zero and significantly improves the intelligence and automation level of security operations.

[0164] The assessment results are recorded in a threat database with query, statistics and analysis functions, realizing centralized and structured management of threat data, providing network administrators with a clear threat view and improving threat response and handling efficiency; by trapping hosts to simulate real services and applications to attract attack behavior, not only is the attack detection capability improved, but also support is provided for subsequent advanced security capabilities such as attack tracing, attacker profiling, and tactical countermeasures.

[0165] By implementing automated alarm filtering and analysis mechanisms, reliance on security personnel is reduced, and the efficiency of security resource utilization is improved. This allows limited human and system resources to be focused on handling and responding to high-value threats. The closed-loop design of the entire process, from attack capture, recording, filtering, and analysis to threat database storage, significantly enhances the integrity and closed-loop response capabilities of the network defense system, providing a solid foundation for building a proactive defense and intelligent response security architecture.

[0166] In one embodiment of the present invention, step S6 includes:

[0167] S61. Based on the results of the threat capture and analysis module and combined with the network topology, design a precise threat host location algorithm; verify the results obtained by the location algorithm to verify the actual location of the threat host;

[0168] S62. Based on the information provided by the location and control module, network administrators take corresponding control measures against threatening hosts;

[0169] S63. Regularly assess the effectiveness of control measures to check whether threats have been effectively controlled; adjust control measures based on the assessment results and provide feedback on the control effectiveness to relevant personnel.

[0170] The working principle of the above technical solution is as follows: Based on the results of the threat capture and analysis module and combined with the network topology, a precise threat host location algorithm is designed; the algorithm should be able to determine the specific network segment and device where the threat host is located by recording information such as the MAC, IP, port, and protocol of the threat host; the results obtained by the location algorithm are verified to ensure the accuracy of the location; the actual location of the threat host can be verified by confirming with network administrators or by conducting on-site inspections.

[0171] Based on the information provided by the location and control module, network administrators take corresponding control measures against threatening hosts; for example, they isolate hosts suspected of being attacked and prevent them from communicating with external networks; and they block hosts confirmed to be engaging in malicious behavior to prevent the threat from spreading further.

[0172] Regularly evaluate the effectiveness of control measures to check whether threats are effectively controlled; adjust control measures in a timely manner based on the evaluation results, and provide feedback on the control effects to relevant personnel to continuously optimize network defense strategies.

[0173] The effects of the above technical solution are as follows: By combining threat capture analysis results with network topology, a precise positioning algorithm is designed to quickly and accurately locate the network segment and specific device where the threat host is located, significantly improving the speed and efficiency of network attack response; from threat discovery and positioning to the implementation of control measures, a complete security closed loop is constructed, enabling the network defense system to have the full-process capability from "threat discovery" to "threat handling", thus improving the integrity of overall security protection;

[0174] Based on threat levels and behavioral characteristics, differentiated control measures such as isolation and blocking are adopted for different types of threat hosts, which significantly enhances the ability to curb malicious behavior and prevents threats from spreading laterally in the network. By regularly evaluating the effectiveness of control measures and dynamically adjusting strategies based on the evaluation results, the continuous optimization capability of the network defense system is significantly improved, ensuring that security strategies are always in sync with the threat situation.

[0175] By providing network administrators with accurate threat location information and control recommendations, the time cost of manual investigation and judgment is significantly reduced, and the intelligence and efficiency of security operations and maintenance are improved. By timely isolating and blocking threat hosts, the spread of attack behavior in the network is effectively curbed, and the chain reaction of security incidents on the overall network security is significantly reduced. By combining threat databases, location algorithms and control modules, the visual tracking and dynamic control of threat hosts are realized, improving the manageability and operability of network defense.

[0176] One embodiment of the present invention provides a depth interference adjustment system for dynamic address hopping attack targets, comprising:

[0177] One or more processors;

[0178] Memory, used to store one or more programs.

[0179] Wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the above.

[0180] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from the spirit and scope of this invention; thus, if these modifications and variations of this invention fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for adjusting the depth of interference in dynamic address jump attack targets, characterized in that, The method includes: S1. Within the user's network area, use network scanning tools to search for free IP addresses in each network segment; based on the collected free IP addresses, generate a large number of decoy hosts; deploy the generated decoy hosts and the user's real hosts on the same side. S2. Determine the hopping range of the decoy host's IP address and set specific IP address ranges according to the network plan; set a hopping port number range for each decoy host and divide different port groups according to service type; list the service types that the decoy host can simulate; assign an initial service type combination to each decoy host according to the network environment and security requirements; determine the applications that the decoy host can simulate and assign an initial application combination to each decoy host according to the actual situation. S3. Use fingerprint learning algorithms to identify real hosts in the network, apply unified obfuscation settings to all real hosts in the network, formulate key obfuscation strategies for specific sensitive hosts or hosts in high-risk areas, and set corresponding obfuscation cycles for different obfuscation strategies. S4. Collect network monitoring data in real time using network monitoring tools; adaptively adjust the dynamic address hopping cycle based on real-time network monitoring data; dynamically optimize the active obfuscation strategy based on changes in attacker behavior patterns and network environment; including: assessing the overall security posture of the network; using a security posture assessment model to quantify and analyze various security indicators to obtain the network security posture level; dynamically adjusting the strength and scope of the active obfuscation strategy based on changes in the security posture level. Based on the attacker's behavior patterns, develop personalized proactive obfuscation strategies; adapt the proactive obfuscation strategies to changes in the network environment. S5. Simulate a large number of ports on the decoy host and monitor access requests for different ports in real time; simulate various services and applications on the decoy host and capture attacks on these services and applications; perform automatic analysis using preset rules and algorithms; and record the automatic analysis results in the threat database. S6. Based on the results of the threat capture and analysis module and the network topology, locate the position of internal threat hosts in real time; determine the specific network segment and device where the threat host is located by recording the information of the threat host; network administrators take corresponding control measures on the threat host based on the information provided by the location and control module. The S3 includes: S31. Automatically learn the characteristics of real hosts in the network through a fingerprint recognition algorithm based on machine learning, perform fingerprint recognition on real hosts in the network, and store the recognition results in the real host fingerprint database. S32. Implement unified obfuscation settings for all real hosts in the network, periodically evaluate the effectiveness of the unified obfuscation strategy, and check whether attackers can bypass the obfuscation settings to identify real hosts. S33. Identify sensitive hosts in the network and develop targeted obfuscation strategies for sensitive hosts and hosts in high-risk areas; S34. Set corresponding obfuscation periods for different obfuscation strategies. When frequent network attack activities are detected, shorten the obfuscation period; when the network environment is stable, extend the obfuscation period.

2. The method for adjusting the depth of interference of attack targets based on dynamic address hopping as described in claim 1, characterized in that, S1 includes: S11. Select a network scanning tool and set the scanning parameters according to the network size and complexity; perform secondary verification on the idle IP addresses obtained from the scan. S12. Use virtualization technology to build an independent system environment for each trapping host and create multiple virtual machines as trapping hosts; S13. Based on the functions of real hosts in the network, set up corresponding simulation functions for the decoy hosts; establish a dynamic adjustment model for the number of decoy hosts, and adjust the number of decoy hosts in real time according to changes in network size and security requirements; when the network size expands or security threats increase, automatically increase the number of decoy hosts; otherwise, decrease them. S14. Based on the network topology, formulate a deployment location planning scheme; distribute the trapping hosts evenly across each network segment, and deploy the trapping hosts and user real hosts on the same side in a mixed manner; S15. Regularly evaluate the effectiveness of hybrid deployments and check whether attackers can distinguish between real hosts and decoy hosts.

3. The method for adjusting the depth of interference of attack targets based on dynamic address hopping as described in claim 1, characterized in that, S2 includes: S21. Based on the network plan, determine the hopping range of the IP address of the decoy host, optimize the determined IP address hopping range, and adopt a dynamic allocation algorithm to adjust the hopping range in real time according to the IP address already used in the network. S22. List the network service ports, divide the ports into different port groups according to the service type, and assign different port groups to each trap host for switching. S23. List the service types that the decoy hosts can simulate, and assign an initial service type combination to each decoy host based on the network environment and security requirements; determine the applications that the decoy hosts can simulate, and assign an initial application combination to each decoy host based on the actual situation. S24. Based on the network's security and performance requirements, set the initial dynamic transition period and formulate a dynamic transition strategy.

4. The method for adjusting the depth of interference of attack targets based on dynamic address hopping as described in claim 1, characterized in that, The S4 includes: S41. Collect network monitoring data in real time using network monitoring tools; store and manage the collected network monitoring data based on the monitoring data storage system; S42. Based on the attack situation analysis algorithm, analyze the network monitoring data collected in real time and judge the frequency of network attack activities. S43. Based on the attack situation analysis results, adaptively adjust the dynamic address hopping period; when frequent network attack activities are detected, shorten the hopping period to 2 to 5 minutes, and when the network environment is stable, extend the hopping period to 10 to 15 minutes. S44. By analyzing network monitoring data, obtain the attacker's behavior patterns, and dynamically optimize the active obfuscation strategy based on the attacker's behavior patterns and changes in the network environment.

5. The method for adjusting the depth of interference of attack targets based on dynamic address hopping as described in claim 4, characterized in that, S41 includes: Network monitoring tools are used to capture data packets in the network in real time, obtain detailed information about network traffic, and analyze the obtained information to obtain network traffic distribution, communication patterns, and potential security threats. Integrate system logs from various devices in the network; collect alarm information from security devices; and transmit the collected network monitoring data to the storage system via a data transmission channel. Before data storage, the collected raw network monitoring data is preprocessed. A distributed storage architecture is adopted to distribute the data across multiple nodes. In conjunction with database technology, different types of data are classified, stored and managed.

6. The method for adjusting the depth of interference of attack targets based on dynamic address hopping as described in claim 4, characterized in that, S44 includes: By using time series analysis algorithms to analyze network monitoring data over long periods, we can uncover the temporal distribution patterns of attack behavior within a day, a week, and a month; and analyze the duration of attack behavior to determine whether it is a short-term, sudden attack or a long-term, continuous infiltration. The system analyzes the number and frequency of attacks by attackers against different types of hosts and network services, and uses correlation analysis algorithms to identify the key characteristics of attack targets that attackers are focusing on. Analyze the attack payloads and protocol characteristics in network monitoring data to identify the attack methods and tools used by attackers; match the detected attack behaviors with known attack methods using an attack signature database to determine the attack type; Real-time monitoring of changes in network topology; obtaining status information and connection relationships of network devices through network management protocols; and constructing a dynamic network topology map. Real-time monitoring and analysis of network traffic is performed to extract characteristic parameters of the traffic. Machine learning algorithms are used to identify normal and abnormal patterns of network traffic. When abnormal changes occur in network traffic, the causes are analyzed to determine whether they are related to attacker behavior, and the active obfuscation strategy is adjusted based on the analysis results.

7. The method for adjusting the depth of interference of attack targets based on dynamic address jump as described in claim 1, characterized in that, The S5 includes: S51. Simulate a large number of ports on the decoy host and monitor access requests for different ports in real time; when abnormal behavior is detected, record relevant attack information; the decoy host simulates multiple services and captures attacks targeting these services. S52. Simulate applications, capture attacks against applications, record detailed attack information, and establish a whitelist for authorized normal security operations. S53. By filtering through a whitelist, alarms generated by normal security services are excluded. When a network attack alarm is received, first check whether the attack source is in the whitelist. If it is, ignore the alarm. S54. For alarms generated after whitelist filtering, use preset rules and algorithms to automatically analyze them; determine whether they are threat host alarms; and record the automatic analysis results in the threat database.

8. The method for adjusting the depth of interference of attack targets based on dynamic address hopping as described in claim 1, characterized in that, The S6 includes: S61. Based on the results of the threat capture and analysis module and combined with the network topology, design a precise threat host location algorithm; verify the results obtained by the location algorithm to verify the actual location of the threat host; S62. Based on the information provided by the location and control module, network administrators take corresponding control measures against threatening hosts; S63. Regularly assess the effectiveness of control measures to check whether threats have been effectively controlled; adjust control measures based on the assessment results and provide feedback on the control effectiveness to relevant personnel.

9. A depth-based interference adjustment system for dynamic address hopping attack targets, comprising: One or more processors; Memory, used to store one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the method of any one of claims 1 to 8.

Images