Non-control IP detection system based on visual tool

Abstract

The invention provides a non-control IP detection system based on a visual tool, and the system comprises a data collection layer which obtains equipment basic information based on an active detection technology and a passive monitoring technology; the analysis processing layer is used for identifying equipment types based on an equipment information base and detecting abnormal behaviors; the business logic layer is used for providing strategy configuration, risk assessment and log management functions; and the display interaction layer provides a visual interface, analyzes data through a report tool, outputs an Excel / PDF format report, and realizes log retrieval and visual alarm. The non-control IP detection system based on the visual tool has the advantages of being scientific in design, easy and convenient to operate and good in protection effect.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to a non-controlled IP detection system based on visual tools. Background Technology

[0002] As a key municipal-level power supply enterprise of the State Grid Corporation of China, the State Grid Corporation of China bears the heavy responsibility of regional power supply, grid construction, and operation and maintenance. With the deepening of smart grid and digital transformation, the company's intranet has continuously expanded, encompassing multiple core business networks such as dispatch control systems, electricity consumption information collection systems, and office automation systems. The number and types of connected devices are vast and complex (e.g., smart meters, substation monitoring terminals, mobile inspection equipment, etc.). However, current network security faces a significant challenge due to the prevalence of vulnerabilities posed by uncontrolled IP devices. Due to historical reasons and business expansion, a large number of uncontrolled IP devices (such as temporarily accessed construction terminals and outdated equipment) exist within the intranet and are not under unified management. These devices could become springboards for attackers. Furthermore, the intranet lacks sufficient network visibility. Existing network topology tools rely on static configuration and cannot dynamically detect device access and abnormal traffic in real time, making it difficult for maintenance personnel to quickly locate unauthorized access or abnormal behavior. The enterprise intranet and critical information infrastructure face increasingly severe security threats, especially the potential for data leakage and malicious attacks from the access of uncontrolled IP devices.

[0003] Therefore, developing an intranet uncontrolled IP detection device based on visualization tools is of great significance for improving intranet security protection capabilities. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing a non-controlled IP detection system based on visual tools.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A non-controlled IP detection system based on visual tools, comprising:

[0007] The data acquisition layer acquires basic device information based on active detection and passive listening technologies.

[0008] The analysis and processing layer identifies equipment types and detects abnormal behavior based on the equipment information database.

[0009] The business logic layer provides functions for policy configuration, risk assessment, and log management.

[0010] The interactive layer provides a visual interface, analyzes data through reporting tools, outputs Excel / PDF reports, and enables log retrieval and visual alerts.

[0011] Active probing technology primarily obtains device information by sending specific network packets and analyzing the responses; passive eavesdropping technology analyzes device information by capturing data packets flowing through specific network nodes.

[0012] Active detection technology discovers online devices by scanning with ICMP / TCP / UDP protocols and obtains IP-MAC binding relationships by combining them with the ARP protocol.

[0013] In a local area network environment, the IP-MAC address mapping of active devices within the same broadcast domain can be obtained by sending ARP Request broadcast messages.

[0014] Once a live IP is found, open ports are identified through port scanning (such as TCP SYN scan, FIN scan, etc.), and application layer protocols are used to probe for more detailed device information.

[0015] Passive monitoring technology uses the port mirroring function of a switch to copy the incoming and outgoing traffic of a specified port to the monitoring port. The switch's traffic analysis module performs in-depth analysis of this traffic to identify the communication entities and operating systems in the network; it also reads the switch's MIB library to obtain device information.

[0016] The switch is configured in Trunk mode, allowing the probe device to receive traffic from all VLANs and parse the raw data packets.

[0017] Analyze traffic characteristics through IDS / IPS systems; regularly check login logs and firewall rule hit records, paying attention to failed logins and abnormal IP access events; divide sensitive network segments into VLANs to restrict cross-regional access permissions; deploy firewalls and vulnerability scanning tools to take temporary blocking or traffic restriction measures against abnormal IPs; combine technical tools with manual analysis to identify and respond to abnormal behavior of internal network IPs.

[0018] Risk scores are generated based on device type, network behavior, and compliance policies.

[0019] This invention has outstanding substantive features and significant progress compared to the prior art. Specifically, this invention provides a non-controlled IP detection system based on visual tools. It adopts a technical architecture that combines distributed network detection and intelligent analysis. Through switch trunk interface data collection, multi-protocol parsing, device information identification, risk modeling, and visualization, it realizes real-time monitoring and security management of non-controlled devices on the intranet. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the functional modules of the present invention. Detailed Implementation

[0021] The technical solution of the present invention will be further described in detail below through specific embodiments.

[0022] like Figure 1 As shown, this embodiment provides a non-controlled IP detection system based on visual tools, characterized in that it includes:

[0023] The data acquisition layer acquires basic device information based on active detection and passive listening technologies.

[0024] The analysis and processing layer identifies equipment types and detects abnormal behavior based on the equipment information database.

[0025] The business logic layer provides functions for policy configuration, risk assessment, and log management.

[0026] The interactive layer provides a visual interface, analyzes data through reporting tools, outputs Excel / PDF reports, and enables log retrieval and visual alerts.

[0027] Specifically, alarm information should include key device identifiers (such as MAC address, detected IP address, VLAN, physical location clues), risk type (such as "suspected unauthorized router" or "unauthorized DHCP server"), and time of discovery.

[0028] In one embodiment, active probing technology primarily obtains device information by sending specific network packets and analyzing the responses; passive eavesdropping technology analyzes device information by capturing data packets flowing through specific network nodes.

[0029] In one embodiment, the active detection technology discovers online devices by scanning with ICMP / TCP / UDP protocols and obtains IP-MAC binding relationships by combining them with the ARP protocol.

[0030] In one embodiment, the IP-MAC address mapping of active devices within the same broadcast domain is obtained by sending an ARP Request broadcast message in a local area network environment.

[0031] In one embodiment, after a live IP is discovered, open ports are identified through port scanning (such as TCP SYN scan, FIN scan, etc.), and probing is attempted using application layer protocols (such as HTTP, FTP, Telnet, SNMP) to obtain more detailed device information, such as device type, operating system version, and service information. For example, the SNMP protocol can be used to obtain rich data from the MIB (Management Information Base) of network devices (such as switches and routers).

[0032] In one embodiment, passive monitoring technology utilizes the switch's port mirroring function to copy the incoming and outgoing traffic of a designated port (such as a port connecting the core or aggregation layer) to the monitoring port. The switch's traffic analysis module performs deep analysis on this traffic, identifying communication entities and operating systems in the network; it also reads the switch's MIB library to obtain device information such as device interfaces, VLANs, and physical locations (LLDP protocol). To improve compatibility, it can integrate IEEE MAC vendor libraries and protocol signature libraries, supporting MIB library parsing for different brands of switches and ensuring compatibility with devices from Huawei, H3C, Cisco, and others. Furthermore, to enhance security, it can also detect unauthorized devices: detecting NAT characteristics, private IP ranges (e.g., 192.168.xx), and unauthorized DHCP services.

[0033] In one embodiment, source IP, destination IP, source MAC, and destination MAC addresses are extracted from mirrored traffic to identify communication entities in the network. Further analysis of DHCP messages can yield information such as the client's requested IP, the assigned IP, the client's MAC address, and the DHCP server's IP, which is crucial for identifying devices that dynamically obtain IP addresses. Furthermore, analyzing DNS queries, HTTP User-Agent, SSL certificates, and other information can help determine the device type (e.g., PC, mobile phone, IoT device) and operating system.

[0034] In one embodiment, the switch is configured in Trunk mode, allowing the probing device to receive traffic from all VLANs and parse the raw data packets.

[0035] In one embodiment, traffic characteristics are analyzed through an IDS / IPS system, such as signature-based known attack detection or behavior-based abnormal pattern identification; login logs and firewall rule hit records are checked regularly, and attention is paid to failed logins and abnormal IP access events; sensitive network segments are divided into VLANs to isolate them and restrict cross-regional access permissions; firewalls and vulnerability scanning tools are deployed to take temporary blocking or traffic restriction measures against abnormal IPs; and abnormal behavior of internal network IPs is identified and responded to by combining technical tools with manual analysis.

[0036] In one embodiment, a risk score is generated based on device type, network behavior, and compliance policies (resulting in high / medium / low risk). Specifically, the risk scoring method can be set according to specific circumstances.

[0037] Specific examples of risk scoring methods are as follows:

[0038] 1. Integrate the collected IP basic data and log behavior data, and build historical data modeling based on the long-term behavior patterns of IPs, such as the average daily number of accesses (e.g., server IPs typically access specific ports stably, and terminal IP access frequencies conform to working hours) and common service types (e.g., finance IPs frequently access the ERP system), to form a static comparison baseline. Specifically, IP basic data includes the network segment to which the IP belongs, the type of device it is bound to (e.g., server, employee terminal), and historical geographical location (tracked through intranet DHCP logs). Log behavior data covers access time (e.g., high-frequency connections outside of working hours), access objects (sensitive databases, unauthorized servers), operation types (file transfer, port scanning), and traffic characteristics (abnormal packet volume, connection duration), etc.

[0039] 2. Then, combine machine learning algorithms (such as cluster analysis) to update the baseline in real time, adapting to periodic changes (such as the peak of financial data transmission at the end of the month) or temporary adjustments (such as the project team temporarily accessing the development server) to form a dynamic comparison baseline.

[0040] 3. Referring to Table 1, the risk characteristics of IP behavior are converted into quantifiable indicators to calculate a risk score. The risk level is determined based on the risk score: Risk Score = Σ(Characteristic Indicator Value × Weight). For example, an IP with "unauthorized access to the database (weight 30%, indicator value 10 points)" + "abnormal traffic in the early morning (weight 15%, indicator value 10 points)" scores 10 × 0.3 + 10 × 0.15 = 4.5 (out of 10). Low risk (<4 points): Trigger an alarm but no immediate action is required (e.g., occasional cross-network segment access); Medium risk (4-7 points): Automatically restrict some permissions of the IP (e.g., prohibit write operations) and notify the administrator; High risk (>7 points): Immediately block the connection and initiate a source tracing process (e.g., isolate the IP and audit related accounts).

[0041] Table 1 Risk weights corresponding to different risk characteristics

[0042]

[0043]

[0044] The above embodiments can be combined with each other.

[0045] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them; although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications can still be made to the specific implementation of the present invention or equivalent substitutions can be made to some technical features without departing from the spirit of the technical solutions of the present invention, and all such modifications and substitutions should be covered within the scope of the technical solutions claimed in the present invention.

Claims

1. A non-controlled IP detection system based on visual tools, characterized in that, include: The data acquisition layer acquires basic device information based on active detection and passive listening technologies. The analysis and processing layer identifies equipment types and detects abnormal behavior based on the equipment information database. The business logic layer provides functions for policy configuration, risk assessment, and log management. The interactive layer provides a visual interface, analyzes data through reporting tools, outputs Excel / PDF reports, and enables log retrieval and visual alerts.

2. The non-controlled IP detection system based on visual tools according to claim 1, characterized in that: Active probing technology primarily obtains device information by sending specific network packets and analyzing the responses; passive eavesdropping technology analyzes device information by capturing data packets flowing through specific network nodes.

3. The non-controlled IP detection system based on visual tools according to claim 2, characterized in that: Active detection technology discovers online devices by scanning with ICMP / TCP / UDP protocols and obtains IP-MAC binding relationships by combining them with the ARP protocol.

4. The non-controlled IP detection system based on visual tools according to claim 2, characterized in that: In a local area network environment, the IP-MAC address mapping of active devices within the same broadcast domain can be obtained by sending ARP Request broadcast messages.

5. The non-controlled IP detection system based on visual tools according to claim 3 or 4, characterized in that: Once a live IP is found, open ports are identified through port scanning, and application layer protocols are used to probe for more detailed device information.

6. The non-controlled IP detection system based on visual tools according to claim 2, characterized in that: Passive monitoring technology uses the port mirroring function of a switch to copy the incoming and outgoing traffic of a specified port to the monitoring port. The switch's traffic analysis module performs in-depth analysis of this traffic to identify the communication entities and operating systems in the network. Read the switch's MIB library to obtain device information.

7. The non-controlled IP detection system based on visual tools according to claim 6, characterized in that: Information is extracted from mirrored traffic to identify communication entities and operating systems in the network.

8. The non-controlled IP detection system based on visual tools according to claim 6, characterized in that: The switch is configured in Trunk mode, allowing the probe device to receive traffic from all VLANs and parse the raw data packets.

9. The non-controlled IP detection system based on visual tools according to claim 8, characterized in that: Analyze traffic characteristics through IDS / IPS systems; regularly check login logs and firewall rule hit records, paying attention to failed logins and abnormal IP access events; divide sensitive network segments into VLANs to restrict cross-regional access permissions; deploy firewalls and vulnerability scanning tools to take temporary blocking or traffic restriction measures against abnormal IPs; combine technical tools with manual analysis to identify and respond to abnormal behavior of internal network IPs.

10. The non-controlled IP detection system based on visual tools according to claim 9, characterized in that: Risk scores are generated based on device type, network behavior, and compliance policies.

Images