Intelligent ship network security defense system integrating active defense and path backtracking

Abstract

The invention discloses an intelligent ship network security defense system integrating active defense and path backtracking, and relates to the technical field of network security. In a ship network system, a network firewall is connected behind a ship wireless communication channel, and meanwhile, a route backtracking module for actively analyzing an abnormal route is connected to a core switch of a ship network; the module records and analyzes all routes on the core switch and gives an alarm for abnormal routes, meanwhile, a virtual network terminal is installed on the network server and used for simulating functional terminal equipment in a ship network to serve as bait of network viruses, and when the viruses invade the virtual terminal, the virtual terminal can send out the network viruses. And the virtual terminal sends a virus intrusion alarm to a network administrator, starts a route backtracking system to carry out route backtracking, and automatically sends a backtracked source to a virus library of the firewall. According to the invention, a passive and active combined method is adopted to carry out network security defense, and the network security can be obviously enhanced compared with a single firewall mode.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, specifically to an intelligent ship cybersecurity defense system that integrates proactive defense and path backtracking. Background Technology

[0002] With the development of digitalization and intelligence in the shipping industry, the application of ship digital networks is extremely common. Its characteristics are small network scale, limited installation space, and the only connection channel between the ship and the Internet is a wireless channel with limited bandwidth. However, the requirements for ship network security are the same as those for land networks. When a ship is sailing or anchored at sea, the wireless network channel is much smaller than that on shore, and the protection and support for network security is much lower than that of land networks. However, once ship network security fails, it will cause great economic losses and security risks to the ship and the company.

[0003] To address ship network security issues, ship networks are generally equipped with network firewalls. For example, the existing technology CN213521957U, a network access system based on digital ship network security, connects its communication network to the core switch via a routed firewall, with each service network directly connected to the core switch, thus helping to ensure ship network security. However, firewalls are essentially a passive defense method based on known virus signature databases. Firewalls alone cannot guarantee that ship networks are immune to virus attacks. Viruses are constantly evolving and mutating. As a passive defense method, once a virus infiltrates the ship network, the lack of effective internal monitoring and response mechanisms means the network system will be unable to detect the threat, leading to problems and even substantial damage to the ship network system.

[0004] Therefore, there is an urgent need in this field for a comprehensive network security defense solution that can adapt to the unique environment of ship networks and possess proactive detection, analysis, response, and self-reinforcing capabilities. In light of this, this case was developed through in-depth research addressing the aforementioned issues. Summary of the Invention

[0005] The purpose of this invention is to provide an intelligent ship network security defense system that integrates active defense and path backtracking, so as to solve the problem that the single firewall passive defense mode proposed in the background art is insufficient in dealing with new network viruses.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an intelligent ship network security defense system integrating active defense and path backtracking, wherein the system is deployed in the ship's network and located after the ship's wireless communication channel; the system includes: The firewall module, connected after the ship's wireless communication channel, is used for the first layer of filtering and defense of data streams entering the ship's network; The route backtracking analysis module is connected to the core switch of the ship network and is used to record and analyze the data routing paths in the network in real time. The virtual network terminal module, deployed on the network server, is configured to simulate at least one functional terminal device in the ship network, serving as a decoy to attract and detect network viruses; The routing backtracking analysis module and the virtual network terminal module are communicatively connected to form an active defense collaborative system. When the virtual network terminal module detects a virus intrusion, it can trigger the routing backtracking analysis module to start path backtracking analysis and automatically feed back the virus source information obtained from the analysis to the firewall module to update its defense strategy.

[0007] While detecting virus intrusion, the route backtracking analysis module and the virtual network terminal module identify abnormal route path information through preset thresholds. According to the actual application scenario of the ship network, thresholds are set for data transmission rate deviation, data transmission frequency deviation, and data packet format matching degree. The data transmission rate deviation threshold is set to ±30% of the normal transmission rate range, the data transmission frequency deviation threshold is set to ±50% of the normal transmission frequency range, and the data packet format matching degree threshold is set to 90%. When the transmission data of a certain route meets any parameter exceeding the corresponding threshold, it is determined to be an abnormal route.

[0008] Preferably, the route backtracking analysis module is configured as follows: Continuously monitor and record the routing path information of all data packets flowing through the core switch; Based on a predefined set of rules or behavioral baselines, the routing path information is analyzed in real time to identify abnormal transmission paths. When an abnormal transmission path is detected, an alarm signal is automatically sent to the network administrator.

[0009] Preferably, the virtual network terminal module is configured as follows: Simulate a virtual terminal that does not exist in actual ship operations and has network vulnerabilities or open services; Monitor all network connection and data access requests initiated to this virtual terminal; When unauthorized, malicious, or virus-like data access is detected, it is determined to be a virus intrusion, and an intrusion alarm is immediately generated.

[0010] Preferably, after determining that a virus has intruded, the virtual network terminal module automatically sends a trigger command containing an intrusion timestamp and source / destination IP addresses to the routing backtracking analysis module.

[0011] Preferably, after receiving the trigger command, the route backtracking analysis module performs the following operations: Starting from the IP address of the virtual network terminal module and the intrusion timestamp, trace back the complete path of all data streams that interacted with the virtual terminal within a specific time window; Analyze each network node along the data flow path to locate the initial source node or IP address of the virus intrusion.

[0012] Preferably, after locating the source of the virus, the route backtracking analysis module automatically generates a firewall rule update instruction and sends the instruction along with the virus source information to the firewall module.

[0013] Preferably, the firewall module is configured to receive and execute the firewall rule update instruction, add the virus source information to its blacklist or blocking policy, thereby blocking all subsequent network access requests from the source.

[0014] The system also includes a data storage unit, which stores all routing transmission data recorded by the routing backtracking analysis module, intrusion data detected by the virtual network terminal module, interception logs of the firewall module, and network security status reports. The storage time is no less than 12 months, and network administrators can query historical data through authorized accounts.

[0015] The system's intelligent ship cybersecurity defense methods include: Passive defense is provided against data entering the ship's network via wireless communication channels through firewall modules; The routing backtracking analysis module is used to proactively monitor and analyze data routing within the network. Actively capture viruses attempting to infiltrate the network through virtual network terminal modules; When the virtual network terminal module detects a virus, it triggers a path tracing process to locate the source of the virus. The virus source information is automatically fed back to the firewall module to update its defense strategy in real time, forming a closed-loop defense.

[0016] Preferably, the "triggering path tracing process to locate the source of the virus" specifically includes: The virtual network terminal module sends a trigger command to the route backtracking analysis module; The route backtracking analysis module traces all data flow paths related to the intrusion event based on the information in the trigger command; By analyzing the behavior of nodes along the data flow path, the initial entry point of the virus can be identified.

[0017] Preferably, the "forming a closed-loop defense" means that the system automatically completes the entire process from "virus intrusion detection" to "source location" and then to "strategy update and blocking" without human intervention, thereby achieving synergistic linkage and self-reinforcement between passive and active defense.

[0018] Compared to existing technologies, this intelligent ship network security defense system, which integrates proactive defense and path backtracking, has the advantage of transforming ship network security from a purely defensive mode to a three-pronged approach of defense, path analysis, and trap capture. This solves the problem of network security issues arising when a passive defense system is unable to detect a virus attack. It changes the single passive security approach to a combined approach of passive security, proactive path analysis, and virus trap capture, forming a comprehensive network security system. Proactive security automatically patches vulnerabilities in passive security after detecting problems, thus enhancing the ship's network security protection capabilities. Specific beneficial effects include: 1. A three-dimensional defense system has been constructed: the single passive defense has been upgraded to a three-in-one three-dimensional defense mode of "passive defense by firewall module + active monitoring by route backtracking analysis module + active trapping by virtual network terminal module", which greatly enriches the defense layers and depth.

[0019] 2. Achieved closed-loop proactive response: The system can automatically complete the entire closed loop from "threat detection" to "source location" and then to "policy update", requiring little or no manual intervention, with fast response speed, greatly compressing the attacker's window of opportunity.

[0020] 3. Possesses self-enhancing capabilities: By automatically feeding back new threat sources discovered by the proactive defense phase to the passive defense layer of the firewall module, the entire system can continuously learn and evolve, and its defense capabilities will continue to improve over time, effectively responding to new and mutated viruses.

[0021] 4. Particularly adapted to ship network environments: This invention fully considers the characteristics of limited network bandwidth and weak support capabilities of ships. It achieves efficient protection through internally deployed lightweight analysis modules and virtual terminals, solving the pain point that ships cannot obtain real-time and powerful shore-based security support when sailing at sea. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the architecture of the intelligent ship network security defense system of the present invention; Figure 2 This is a flowchart illustrating the integration of proactive defense and path backtracking in this invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Please see Figure 1-2 This invention provides a technical solution: an intelligent ship network security defense system integrating active defense and path backtracking, the system being deployed in the ship's network and located after the ship's wireless communication channel; the system includes: The firewall module, connected after the ship's wireless communication channel, is used for the first layer of filtering and defense of data streams entering the ship's network; The route backtracking analysis module is connected to the core switch of the ship network and is used to record and analyze the data routing paths in the network in real time. The virtual network terminal module, deployed on the network server, is configured to simulate at least one functional terminal device in the ship network, serving as a decoy to attract and detect network viruses; The routing backtracking analysis module and the virtual network terminal module are connected to form a proactive defense collaborative system. When the virtual network terminal module detects a virus intrusion, it can trigger the routing backtracking analysis module to start path backtracking analysis and automatically feed back the virus source information obtained from the analysis to the firewall module to update its defense strategy.

[0025] While detecting virus intrusion, the route backtracking analysis module and the virtual network terminal module identify abnormal route information through preset thresholds. Based on the actual application scenario of the ship network, thresholds are set for data transmission rate deviation, data transmission frequency deviation, and data packet format matching degree. The data transmission rate deviation threshold is set to ±30% of the normal transmission rate range, the data transmission frequency deviation threshold is set to ±50% of the normal transmission frequency range, and the data packet format matching degree threshold is set to 90%. When the transmission data of a certain route meets any parameter exceeding the corresponding threshold, it is determined to be an abnormal route.

[0026] Preferably, the route backtracking analysis module is configured as follows: Continuously monitor and record the routing path information of all data packets flowing through the core switch; Based on predefined rule sets or behavioral baselines, routing path information is analyzed in real time to identify abnormal transmission paths; When an abnormal transmission path is detected, an alarm signal is automatically sent to the network administrator.

[0027] Preferably, the virtual network terminal module is configured as follows: Simulate a virtual terminal that does not exist in actual ship operations and has network vulnerabilities or open services; Monitor all network connection and data access requests initiated to this virtual terminal; When unauthorized, malicious, or virus-like data access is detected, it is determined to be a virus intrusion, and an intrusion alarm is immediately generated.

[0028] Preferably, after determining that a virus has intruded, the virtual network terminal module automatically sends a trigger command containing an intrusion timestamp and source / destination IP addresses to the routing backtracking analysis module.

[0029] Preferably, after receiving the trigger command, the route backtracking analysis module performs the following operations: Starting with the IP address and intrusion timestamp of the virtual network terminal module, trace back the complete path of all data streams that interacted with the virtual terminal within a specific time window; Analyze each network node along the data flow path to pinpoint the initial source node or IP address of the virus intrusion.

[0030] Preferably, after locating the source of the virus, the route backtracking analysis module automatically generates a firewall rule update command and sends the command along with the virus source information to the firewall module.

[0031] Preferably, the firewall module is configured to receive and execute firewall rule update instructions, adding the virus source information to its blacklist or blocking policy, thereby blocking all subsequent network access requests from that source.

[0032] The system also includes a data storage unit, which stores all routing transmission data recorded by the routing backtracking analysis module, intrusion data detected by the virtual network terminal module, interception logs from the firewall module, and network security status reports. The storage time is no less than 12 months, and network administrators can query historical data through authorized accounts.

[0033] The system's intelligent ship cybersecurity defense methods include: Passive defense is provided against data entering the ship's network via wireless communication channels through firewall modules; The routing backtracking analysis module is used to proactively monitor and analyze data routing within the network. Actively capture viruses attempting to infiltrate the network through virtual network terminal modules; When the virtual network terminal module detects a virus, it triggers a path tracing process to locate the source of the virus. The virus source information is automatically fed back to the firewall module to update its defense strategy in real time, forming a closed-loop defense.

[0034] Preferably, the "triggering path backtracking process to locate the source of the virus" specifically includes: The virtual network terminal module sends a trigger command to the route backtracking analysis module; The route backtracking analysis module traces all data flow paths related to the intrusion event based on the information in the trigger command; By analyzing the behavior of nodes along the data flow path, the initial entry point of the virus can be identified.

[0035] Preferably, "forming a closed-loop defense" means that the system automatically completes the entire process from "virus intrusion detection" to "source location" and then to "strategy update and blocking" without human intervention, thereby achieving synergistic linkage and self-reinforcement between passive and active defense. like Figure 2 As shown, the intelligent ship cybersecurity defense of this system includes the following steps: S1: The ship's wireless communication channel receives data from external networks and transmits the data to the network firewall; S2: The network firewall filters the received data, intercepts data containing known viruses, and transmits data without known viruses to the core switch. S3: The route backtracking analysis module collects all route transmission data on the core switch in real time, analyzes the data and compares it with the normal route transmission model. If an abnormal route is identified, it immediately alerts the network administrator. S4: The virtual network terminal simulates the ship's functional terminal equipment, monitors whether there is data access in real time, and if data access is detected, it determines whether it is a virus intrusion; if it is determined to be a virus intrusion, it sends an intrusion alarm to the network administrator and triggers the route backtracking module to start route backtracking to obtain the virus source information; S5: The virtual network terminal transmits the virus source information to the network firewall, which adds the source information to the virus database to block subsequent intrusions from that source. S6: Integrates anomaly information from the routing backtracking module, intrusion information from virtual network terminals, and interception information from the network firewall to generate a network security status report, and optimizes the operating parameters of each module based on the report.

[0036] The following provides a specific explanation in the context of ship applications: 001. Overall System Deployment Reference Figure 1 The deployment location of this system is as follows: The ship connects to the shore-based internet via a satellite communication antenna or mobile communication module, forming a wireless communication channel. The firewall module of this system is directly deployed between this wireless communication channel and the ship's internal network. The ship's internal network consists of a core switch.

[0037] 002. Implementation of the Firewall Module In this example, the firewall module uses a FortiGate 60F hardware firewall. Its main configuration is as follows: Operating mode: Configured as routing mode, with its WAN port connected to wireless communication devices and its LAN port connected to the core switch.

[0038] Security policy: Enable Intrusion Prevention System (IPS) and Antivirus (AV) functions, and set them to update the signature database online daily.

[0039] Management Interface: Enable the HTTPS-API interface and set the IP address to 192.168.1.1 to receive instructions from the route backtracking analysis module.

[0040] 003. Implementation of the Route Backtracking Analysis Module This module uses a CentOS 7.6 operating system instance deployed on a server, with hardware configurations no less than: an Intel Xeon E-2234 quad-core processor, 8GB of memory, and a 2TB hard drive for storage.

[0041] Traffic Acquisition: Configure port mirroring on the core switch to mirror traffic destined for all network ports to the network port connected to the server of this module.

[0042] Analysis software: Deploy customized analysis software built on the Zeek network security monitoring platform. Zeek is responsible for parsing network traffic into structured log files in real time, recording detailed information for each connection.

[0043] Analysis logic: Learning period: When the system is first started, a 7-day learning period is set to automatically establish a baseline for the normal communication behavior of each IP address in the network.

[0044] Anomaly Detection: After the learning period ends, real-time detection will be initiated. If an internal IP is found to attempt to establish a connection with an unknown external IP outside of working hours, and that external IP is not on any trusted list, this will be considered abnormal routing behavior.

[0045] Alarm: Once an anomaly is detected, the analysis module will immediately send an alarm log to the administrator workstation.

[0046] 004. Implementation of the Virtual Network Terminal Module This module is deployed as a virtual machine on the virtualization platform of the ship's server.

[0047] System configuration: The virtual machine is installed with a minimal system and assigned the IP address 192.168.1.100.

[0048] Service Simulation: This virtual terminal module is equipped with a lightweight host intrusion detection system to monitor its own file system changes, network connection attempts, and abnormal process activity. Any unauthorized access to the simulated port, brute-force attempts, or execution of suspicious scripts will be identified as a virus intrusion event by HIDS.

[0049] 005. Workflow of the Cooperative Defense Mechanism When the virtual network terminal module detects an intrusion, the system's collaborative workflow is automatically executed according to the following steps: Trigger command: The virtual terminal module sends a trigger command to the route backtracking analysis module through a secure RESTful API interface: { "event_id": "honeypot_alert_001", "source_ip": "192.168.1.100", "attacker_ip": "203.0.113.200", "timestamp": "2023-10-27T08:15:00Z", "event_detail": "SSH login attempt with root / 123456" } Path backtracking: Upon receiving this instruction, the customized program of the route backtracking analysis module immediately initiates the backtracking task. The program searches the log files generated by Zeek for all connection records communicating with 192.168.1.100 within the corresponding time range. Analysis confirms the external IP address of the initial attack source.

[0050] Policy Update: After the route backtracking analysis module confirms the external IP address of the initial attack source, it automatically generates a firewall rule. It connects to the firewall module via another SSH or HTTPS API and executes a predefined script command: config firewall address edit "Blocked_Attacker_20231027" set subnet 203.0.113.200 255.255.255.255 set comment "Auto-blocked by Honeypot-RouteBacktrace System" next end Configure firewall policy edit 0 set action deny set srcaddr "Blocked_Attacker_20231027" set dstaddr "all" set service "ALL" set logtraffic all next end This command creates an address object in the firewall and generates a security policy that denies all traffic to this address, thus achieving automatic blocking.

[0051] Through the above specific implementation methods, the system of the present invention can be constructed and operated, realizing a fully automated closed-loop defense from threat detection, analysis to response.

[0052] Contents not described in detail in this specification are prior art known to those skilled in the art. Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An intelligent ship network security defense system integrating proactive defense and path tracing, characterized in that, The system is deployed within the ship's network and located downstream of the ship's wireless communication channel; the system includes: The firewall module, connected after the ship's wireless communication channel, is used for the first layer of filtering and defense of data streams entering the ship's network; The route backtracking analysis module is connected to the core switch of the ship network and is used to record and analyze the data routing paths in the network in real time. The virtual network terminal module, deployed on the network server, is configured to simulate at least one functional terminal device in the ship network, serving as a decoy to attract and detect network viruses; The routing backtracking analysis module and the virtual network terminal module are communicatively connected to form an active defense collaborative system. When the virtual network terminal module detects a virus intrusion, it can trigger the routing backtracking analysis module to start path backtracking analysis and automatically feed back the virus source information obtained from the analysis to the firewall module to update its defense strategy.

2. The intelligent ship network security defense system integrating active defense and path backtracking according to claim 1, characterized in that: The route backtracking analysis module is configured as follows: Continuously monitor and record the routing path information of all data packets flowing through the core switch; Based on a predefined set of rules or behavioral baselines, the routing path information is analyzed in real time to identify abnormal transmission paths. When an abnormal transmission path is detected, an alarm signal is automatically sent to the network administrator.

3. The intelligent ship network security defense system integrating active defense and path backtracking according to claim 1, characterized in that: The virtual network terminal module is configured as follows: Simulate a virtual terminal that does not exist in actual ship operations and has network vulnerabilities or open services; Monitor all network connection and data access requests initiated to this virtual terminal; When unauthorized, malicious, or virus-like data access is detected, it is determined to be a virus intrusion, and an intrusion alarm is immediately generated.

4. The intelligent ship network security defense system integrating active defense and path backtracking according to claim 3, characterized in that: After determining that a virus has intruded, the virtual network terminal module automatically sends a trigger command containing an intrusion timestamp and source / destination IP addresses to the routing backtracking analysis module.

5. The intelligent ship network security defense system integrating active defense and path backtracking according to claim 4, characterized in that: Upon receiving the trigger command, the route backtracking analysis module performs the following operations: Starting from the IP address of the virtual network terminal module and the intrusion timestamp, trace back the complete path of all data streams that interacted with the virtual terminal within a specific time window; Analyze each network node along the data flow path to locate the initial source node or IP address of the virus intrusion.

6. The intelligent ship network security defense system integrating active defense and path backtracking according to claim 5, characterized in that: After locating the source of the virus, the routing backtracking analysis module automatically generates a firewall rule update instruction and sends the instruction along with the virus source information to the firewall module.

7. The intelligent ship network security defense system integrating active defense and path backtracking according to claim 6, characterized in that: The firewall module is configured to receive and execute the firewall rule update instruction, add the virus source information to its blacklist or blocking policy, thereby blocking all subsequent network access requests from that source.

8. A method for intelligent ship network security defense based on the system described in any one of claims 1-7, characterized in that, The method includes: Passive defense is provided against data entering the ship's network via wireless communication channels through firewall modules; The routing backtracking analysis module is used to proactively monitor and analyze data routing within the network. Actively capture viruses attempting to infiltrate the network through virtual network terminal modules; When the virtual network terminal module detects a virus, it triggers a path tracing process to locate the source of the virus. The virus source information is automatically fed back to the firewall module to update its defense strategy in real time, forming a closed-loop defense.

9. The intelligent ship network security defense method according to claim 8, characterized in that: The trigger path backtracking process of the method, which locates the source of the virus, specifically includes: The virtual network terminal module sends a trigger command to the route backtracking analysis module; The route backtracking analysis module traces all data flow paths related to the intrusion event based on the information in the trigger command; By analyzing the behavior of nodes along the data flow path, the initial entry point of the virus can be identified.

10. The intelligent ship network security defense method according to claim 8, characterized in that: The method forms a closed-loop defense, which includes the system automatically completing the entire process from "virus intrusion detection" to "source location" and then to "strategy update and blocking" without human intervention, thereby realizing the synergistic linkage and self-reinforcement of passive and active defense.

Images