A network threat terminal isolation method, system and device

Abstract

This invention discloses a method, system, and device for isolating network threat terminals, belonging to the field of intrusion detection. The method includes: collecting address change records and resource type access logs of each terminal; comparing the current access behavior of each terminal with the historical behavior baseline vector based on the resource type access logs to identify terminals with sudden access changes and terminals with stable access; performing identity spoofing detection on stable access terminals to obtain spoofing detection results; combining the results of terminals with sudden access changes and spoofing detection, determining the set of compromised terminals in the network through preset association judgment rules; obtaining the port transmission volume corresponding to each terminal in the set of compromised terminals, and analyzing the cross-network segment access frequency and the number of non-standard port connections of content within a preset time period based on the port transmission volume; if preset conditions are met, the threat terminal is identified, and the threat terminal is isolated from the network. Therefore, this invention can effectively isolate threat devices from the network.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection, and more particularly to a method, system, and device for isolating network threat terminals. Background Technology

[0002] In the network environment, accurately identifying and rapidly isolating maliciously compromised terminals (i.e., "captured terminals") is a crucial line of defense for curbing the escalation of cybersecurity incidents and ensuring the security of core assets. Once a terminal is compromised, attackers can not only steal sensitive data from it but also use it as a springboard to launch lateral movement within the network, infiltrating critical servers, spreading malware, or paralyzing business systems, leading to serious consequences such as data breaches and service interruptions. Therefore, automatically and accurately locating and isolating compromised terminals from the network in the early stages of a threat can effectively break the attack chain, minimize the scope of damage, and is an indispensable part of a proactive defense system.

[0003] Existing technologies typically rely on a single or limited dimension for identification, resulting in significant shortcomings in accuracy. For example, detection methods based on static signature features (such as malicious IPs or virus hashes) struggle to handle unknown threats and rapid variants. Alerts based solely on abnormal traffic thresholds (such as a sudden surge in connection counts) or simple behavioral deviations generate numerous false alarms, misinterpreting normal business fluctuations or changes in user behavior as attacks. This necessitates manual intervention for analysis, which is inefficient and prone to missing genuine threats. Consequently, these technologies are insensitive to highly concealed and persistent internal penetration detection, leading to the risk of missed detections and making isolation actions either too delayed or insufficiently accurate. Summary of the Invention

[0004] This invention provides a method, system, and device for isolating network threat terminals, which can accurately identify terminal devices that have been maliciously controlled in a network environment and automatically implement effective network isolation.

[0005] This invention provides a method for isolating network threat terminals, comprising: Collect address change records and resource type access logs from each terminal at the network access point; Based on the access logs of the resource type, the current access behavior of each terminal is compared with the historical behavior baseline vector to identify terminals with sudden access changes and terminals with stable access. Identity spoofing detection is performed on the stable access terminals to obtain spoofing detection results. Combining the terminals with sudden access changes and the spoofing detection results, the set of compromised terminals in the network is determined by a preset association judgment rule. The system obtains the port transmission volume corresponding to each terminal in the compromised terminal set, and analyzes the cross-network segment access frequency and the number of unconventional port connections for a preset time period based on the port transmission volume. If the cross-network segment access frequency and the number of unconventional port connections meet preset conditions, the system determines the threat terminal with lateral movement behavior and isolates the threat terminal from the network.

[0006] This invention, by collecting and comparing terminal resource type access logs with historical behavior baselines, can keenly capture abnormal changes in behavioral patterns and quickly filter out suspicious "access mutation terminals," providing a first-level clue for early threat detection. By performing identity spoofing detection on terminals with stable behavior, it can effectively identify terminals that may have been hijacked and impersonated but whose behavior is disguised as normal, filling the blind spots of simple behavioral analysis and significantly reducing the false negative rate. Furthermore, by combining these two different dimensions of suspicious clues—"behavioral mutation" and "identity spoofing"—with the network layer fact of terminal address change records for correlation judgment, it establishes a comprehensive understanding of the underlying threats. A compromised endpoint set was constructed, and the rule combining behavioral anomalies and identity credibility greatly improves the accuracy of the judgment results and effectively avoids false alarms from single indicators. By analyzing the cross-segment access frequency and abnormal port connection behavior in the port transmission volume of each port in the compromised endpoint set, the threat endpoints that are carrying out substantial penetration and spread can be accurately identified from suspicious endpoints, making the isolation targets clearer. By performing automated isolation operations based on network switches on threat endpoints confirmed to have lateral movement behavior, the attack chain can be quickly cut off to prevent the threat from spreading, realizing a security closed loop from accurate identification to automatic handling.

[0007] Furthermore, the step of comparing the current access behavior of each terminal with the historical behavior baseline vector based on the resource type access log to identify terminals with sudden access changes and terminals with stable access includes: Based on the historical resource type access logs of each terminal, the first percentage of access times for each type of resource is calculated, and a historical behavior baseline vector of each terminal is constructed based on the first percentage. Based on the resource type access logs in the current monitoring window of each terminal, the second percentage of access times for each type of resource is calculated, and the current behavior vector is constructed based on the second percentage. Calculate the behavioral similarity value between the current behavior vector and the historical behavior baseline vector; If the behavioral similarity value is lower than a preset similarity threshold, the corresponding terminal will be marked as a terminal accessing a mutation terminal; otherwise, it will be marked as a terminal accessing a stable terminal.

[0008] By collecting and comparing the resource type access logs of the terminal with the historical behavior baseline, it is possible to keenly capture abnormal changes in behavior patterns and quickly filter out suspicious "access mutation terminals", providing the first layer of clues for early threat discovery.

[0009] Furthermore, the step of calculating the first percentage of access times for each type of resource based on the historical resource type access logs of each terminal includes: Based on the current time, obtain the historical resource type access logs of all resource types for each terminal within the preset historical time period; The preset historical duration is divided into several statistical periods, and the percentage of access to various types of resources in each statistical period is calculated as the percentage of the total number of accesses in the corresponding period. The first proportion is obtained by averaging the proportions of the cycles.

[0010] Further, the step of performing identity spoofing detection on the stable access terminal to obtain spoofing detection results includes: Obtain the first communication characteristic data of the stable access terminal at the first moment and the second communication characteristic data at the second moment; Device features of a preset dimension are extracted from the first communication feature data and the second communication feature data respectively to construct a first device feature vector and a second device feature vector; Calculate the device similarity between the first device feature vector and the second device feature vector; If the device similarity is lower than a preset consistency threshold, the corresponding terminal is suspected of identity forgery, and a forgery detection result is generated.

[0011] By performing identity forgery detection on terminals with stable behavior, it is possible to effectively identify terminals that may have been hijacked and misused but whose behavior is disguised as normal, thus making up for the blind spots of simple behavior analysis and significantly reducing the false negative rate.

[0012] Furthermore, the forgery detection results include legitimate conversion devices and identity forgery devices. The step of combining the access mutation terminal and the forgery detection results to determine the set of compromised terminals in the network through preset association judgment rules includes: Based on the address change records, the first address change state corresponding to the access mutation terminal and the second address change state corresponding to the identity forgery device are determined respectively. If the first address change state is fixed or if the second address change state is changing, then the corresponding access mutation terminal and the identity forgery device are added to the compromise terminal set.

[0013] By combining two different types of suspicious clues, "behavioral mutation" and "identity forgery," with the network layer fact of terminal address change records for correlation judgment, a set of compromised terminals is constructed. This rule integrates behavioral anomalies and identity credibility, which greatly improves the accuracy of the judgment results and effectively avoids false alarms from single indicators.

[0014] Furthermore, the analysis of cross-segment access frequency and non-standard port connection frequency based on the transmission volume of each port within a preset time period includes: Based on the source address and destination address in the port transmission data, the frequency of cross-network segment accesses of each terminal in the compromised terminal set within the preset time period is counted. Based on the target port number in the port transmission data, identify non-standard ports that do not belong to the preset standard service port list within the preset time period, and count the number of non-standard port connections that occur within the preset time period.

[0015] By analyzing two key behavioral indicators, "frequency of cross-network segment access" and "number of connections to unconventional ports," this approach accurately captures the typical lateral movement and covert communication characteristics of attackers after gaining control of the terminal. This allows for further differentiation of the "suspicious terminal set" selected in the previous steps into general abnormal terminals and high-risk "threat terminals," greatly improving the accuracy of the final isolation target. It ensures that automated isolation actions are precisely applied to terminals that are carrying out internal network penetration, avoiding false isolation.

[0016] Furthermore, if the frequency of cross-network segment access and the number of unconventional port connections meet preset conditions, then the threat terminal exhibiting lateral movement behavior is determined, including: If the cross-network segment access frequency of any terminal in the compromised terminal set is greater than or equal to a preset first threshold, and the number of connections to the unconventional port shows a continuous increase within multiple consecutive observation windows, then the corresponding terminal is determined to meet the preset conditions, and the corresponding terminal is identified as a threat terminal with lateral movement behavior.

[0017] By analyzing the cross-segment access frequency and unconventional port connection behavior in the port traffic of each port of the compromised terminal, it is possible to accurately identify the threat terminals that are carrying out substantial penetration and spread from suspicious terminals, making the isolation target clearer.

[0018] Furthermore, the network isolation of the threatening terminal includes: Based on the media access control address of the threat terminal, query the physical port of the network switch it is connected to; Send a configuration command to the network switch to migrate the virtual LAN to which the physical port belongs from the service virtual LAN to the isolation virtual LAN, and add a deny rule with the media access control address as the source address to the access control list of the network switch.

[0019] By performing automated isolation operations based on network switches on threat terminals confirmed to exhibit lateral movement behavior, the attack chain can be quickly cut off, the threat spread can be prevented, and a security closed loop from accurate identification to automatic handling can be achieved.

[0020] Another embodiment of the present invention also provides an isolation system for network threat terminals, including: The data acquisition module is used to collect address change records and resource type access logs from each terminal at the network access point. The judgment module is used to compare the current access behavior of each terminal with the historical behavior baseline vector according to the access log of the resource type to identify terminals with sudden access changes and terminals with stable access. The stable access terminals are subjected to identity forgery detection to obtain forgery detection results. The combination of the terminals with sudden access changes and the forgery detection results is used to determine the set of compromised terminals in the network through preset association judgment rules. The isolation module is used to obtain the port transmission volume corresponding to each terminal in the compromised terminal set, and analyze the cross-network segment access frequency and the number of unconventional port connections of the content within a preset time period based on the port transmission volume. If the cross-network segment access frequency and the number of unconventional port connections meet preset conditions, the threat terminal with lateral movement behavior is identified, and the threat terminal is isolated from the network.

[0021] Another embodiment of the present invention provides a terminal device, including: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the steps of the method for isolating network threat terminals as described in the present invention. Attached Figure Description

[0022] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating one embodiment of the method for isolating network threat terminals provided in this application; Figure 2 This is a flowchart illustrating one embodiment of steps S201 to S204 provided in this application; Figure 3 This is a flowchart illustrating one embodiment of steps S301 to S304 provided in this application; Figure 4 This is a schematic diagram of the structure of one embodiment of the network threat terminal isolation system provided in this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0026] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0027] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0028] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0029] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0030] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0031] In a network environment, accurately identifying and quickly isolating maliciously compromised terminals (i.e., "captured terminals") is a crucial line of defense for curbing the escalation of cybersecurity incidents and ensuring the security of core assets. Existing technologies typically rely on a single or limited dimension for identification, resulting in significant shortcomings in accuracy.

[0032] See Figure 1 To accurately identify maliciously controlled terminal devices in a network environment and automatically implement effective network isolation, an embodiment of the present invention provides a method for isolating network threat terminals, including steps S101 to S103: Step S101: Collect address change records and resource type access logs of each terminal from the network access point; In some embodiments, port mirroring is first configured on the network access layer switch to copy all inbound and outbound network traffic from the specified access port to the monitoring port. Then, a data acquisition server connected to the monitoring port continuously captures raw Ethernet frames using a packet capture library (such as libpcap). Next, the Ethernet frame header of each frame is parsed to extract the source MAC address and destination MAC address fields. For each access port, a MAC address activity table is maintained, recording every MAC address appearing on that port, along with its first appearance timestamp and most recent active timestamp. By comparing changes in the set of MAC addresses on the same port within a preset time window (e.g., 5 minutes), when a new MAC address is detected or an existing MAC address has been inactive for a specific period, an address change record is generated. This record includes the port that changed, the MAC address involved, the type of change (new or offline), and the time of the change.

[0033] In some embodiments, after capturing the raw Ethernet data frame, deep packet inspection is performed on the Ethernet data frame to parse its application layer protocol content; then, based on the parsed path characteristics (such as containing " / api / "), file extensions (such as .sql and .pdf) or query patterns, the accessed resources are classified into predefined types such as database queries, file downloads, or Web service calls; finally, the terminal's MAC address, access timestamp, target address, and the classified resource type are associated to generate a structured resource type access log.

[0034] It should be noted that for HTTP / HTTPS protocols, the URI path or parameters in the request line are extracted; for database protocols, the query statement is identified.

[0035] Step S102: Based on the resource type access log, compare the current access behavior of each terminal with the historical behavior baseline vector to identify access mutation terminals and access stable terminals. Perform identity spoofing detection on the access stable terminals to obtain spoofing detection results. Combine the access mutation terminals and the spoofing detection results to determine the set of compromised terminals in the network through preset association judgment rules. Please refer to Figure 2 In some embodiments, the step of comparing the current access behavior of each terminal with the historical behavior baseline vector based on the resource type access log to identify terminals with sudden access changes and terminals with stable access includes steps S201 to S204: Step S201: Calculate the first percentage of access times for each type of resource based on the historical resource type access logs of each terminal, and construct a historical behavior baseline vector for each terminal based on the first percentage. In some embodiments, the step of calculating the first percentage of access counts for various resource types based on the historical resource type access logs of each terminal includes: using the current time as a baseline, obtaining the historical resource type access logs for all resource types of each terminal within a preset historical period; dividing the preset historical period into several statistical periods, and calculating the period percentage of access counts for each type of resource within each statistical period relative to the total access counts of the corresponding period; and averaging the period percentages to obtain the first percentage. Specifically, firstly, using the current time as a baseline, extracting all access records of the target terminal within a continuous period (e.g., thirty days) from the stored resource type access logs, where each record includes a timestamp and a category tag of the accessed resource (e.g., "database query", "file download", or "Web service call"). Subsequently, the historical period is evenly divided into multiple statistical periods, each period typically being one day, and within each statistical period, the total number of access counts for each type of resource by the terminal is accumulated, and the percentage of access counts for that type of resource relative to the total number of access counts for all resources within that period is calculated, thus obtaining the period percentage of each type of resource within that period. Finally, for each type of resource, the arithmetic average of the multiple period percentages calculated from all statistical periods is taken, and the resulting average is the first percentage used to construct the historical behavior baseline vector.

[0036] In some embodiments, a historical behavior baseline vector for each terminal is constructed based on the first proportion. Specifically, the calculated first proportion is arranged in a predefined order of resource categories, and the "first proportion" values ​​corresponding to each resource category are arranged sequentially to form a multi-dimensional vector. The number of dimensions of this vector is consistent with the total number of resource categories, and the value of each dimension represents the habitual proportion of the terminal accessing that type of resource in long-term historical activities. For example, if the first proportions of database queries, file downloads, and Web service calls in a terminal's historical access are 60%, 30%, and 10%, respectively, then the constructed historical behavior baseline vector is [0.6, 0.3, 0.1].

[0037] It should be noted that the first dimension of the resource category order corresponds to "database query", the second dimension corresponds to "file download", and the third dimension corresponds to "web service call".

[0038] It should be noted that the historical behavior baseline vector is a multi-dimensional vector composed of the "first proportion" (i.e., the long-term historical average proportion) of access to various resources arranged in a fixed order. It is used to characterize the habitual access proportion of the terminal in long-term historical activities. The current behavior vector is a vector composed of the "second proportion" (i.e., the proportion of access to various resources within the current monitoring window) arranged in the same order. It is used to characterize the terminal's recent real-time access behavior. The periodic proportion is the proportion of access to a certain type of resource to the total number of accesses in a single statistical period (e.g., one day).

[0039] Step S202: Based on the resource type access logs in the current monitoring window of each terminal, calculate the second percentage of access times for each type of resource, and construct the current behavior vector based on the second percentage; In some embodiments, all access records of the target terminal within the current monitoring window are extracted from the real-time collected resource type access logs. The current monitoring window is typically set to the most recent 24 hours. Following the same resource type classification method as the historical baseline, the number of times the terminal accesses each type of resource within this window, and the proportion of each type of resource access to the total number of accesses in the current window, are calculated to obtain the resource percentage for the current window. Similarly, following a fixed order of database query, file download, and web service, these three percentages are arranged into a three-dimensional vector as the terminal's current behavior vector.

[0040] Step S203: Calculate the behavior similarity value between the current behavior vector and the historical behavior baseline vector; In some embodiments, the historical behavior baseline vector and the current behavior vector are regarded as direction vectors in two multidimensional spaces. First, the sum of the product of the corresponding dimension values ​​of the two vectors is calculated, then the magnitude of each vector is calculated separately, and then the sum of the vector products is divided by the product of the two magnitudes. The result is the behavior similarity value.

[0041] It should be noted that the value of the behavior similarity score ranges from 0 to 1. The closer it is to 1, the more similar the current behavior is to the historical pattern; the closer it is to 0, the greater the difference.

[0042] Step S204: If the behavior similarity value is lower than a preset similarity threshold, the corresponding terminal is marked as a terminal accessing a mutation terminal; otherwise, it is marked as a terminal accessing a stable terminal.

[0043] In some embodiments, firstly, a similarity threshold is preset, and then the behavioral similarity value is compared with the similarity threshold: if the value is lower than the threshold, it is determined that the terminal's access behavior has undergone a significant change, and it is marked as an access change terminal; if the value is not lower than the threshold, it is determined that its access behavior remains stable, and it is marked as an access stable terminal.

[0044] It should be noted that the similarity threshold is determined by statistically analyzing the historical similarity distribution of a large number of terminals during normal business periods, and is usually set at the level of the distribution mean minus one standard deviation.

[0045] It should be noted that accessing a mutated terminal refers to a terminal whose current behavior vector and historical behavior baseline vector have a behavior similarity value lower than a preset threshold. Accessing a stable terminal refers to a terminal whose behavior similarity value is not lower than the preset threshold.

[0046] By collecting and comparing the resource type access logs of the terminal with the historical behavior baseline, it is possible to keenly capture abnormal changes in behavior patterns and quickly filter out suspicious "access mutation terminals", providing the first layer of clues for early threat discovery.

[0047] Please refer to Figure 3 In some embodiments, the step of performing identity spoofing detection on the stable access terminal to obtain a spoofing detection result includes steps S301 to S304: Step S301: Obtain the first communication feature data of the stable access terminal at the first moment and the second communication feature data at the second moment; In some embodiments, after a terminal is marked as a stable access terminal, two key time points in the terminal's network communication log are located where its MAC address changes. Then, based on the address change time, a time window is extracted both before and after the change (e.g., 10 minutes before and after the change). From the network traffic within these two windows, all network connection request packets initiated by the terminal are completely extracted. The collection of these packets constitutes the first-time communication feature data and the second-time communication feature data for comparison.

[0048] Step S302: Extract device features of a preset dimension from the first communication feature data and the second communication feature data respectively to construct a first device feature vector and a second device feature vector; In some embodiments, features are extracted sequentially from two sets of communication feature data from a predefined list of device feature dimensions. The main extracted dimensions include: the operating system version identifier string parsed from TCP / IP or HTTP protocol header fields; the browser User-Agent string obtained from the HTTP request header, and its major version number extracted; the list of cipher suites ordered by priority by the client, recorded in the ClientHello message during the TLS handshake phase; and the clock offset calculated by comparing the terminal data packet timestamp with the network time protocol server timestamp. Then, the feature values ​​of the above dimensions extracted from the first time-of-flight data are combined in a fixed order to form a first device feature vector; the second time-of-flight data is processed using the same rules to construct a second device feature vector.

[0049] Step S303: Calculate the device similarity between the first device feature vector and the second device feature vector; In some embodiments, to quantify the degree of change of device features at two points in time, a strategy of dimensional comparison and comprehensive evaluation is adopted: for strings or enumerated values ​​such as operating system version and browser major version number, precise matching is performed; for a list of encryption suites, the consistency of their sequence content and order is compared; for numerical values ​​such as clock offset, their absolute difference is calculated. Subsequently, a similarity score is assigned to the comparison result of each dimension (e.g., 1.0 for complete similarity and 0.0 for complete inconsistency), and different weights are assigned according to the stability and importance of each dimension feature in device identification. Finally, a comprehensive device similarity value is calculated by weighted summation.

[0050] Step S304: If the device similarity is lower than a preset consistency threshold, the corresponding terminal is suspected of identity forgery, and a forgery detection result is generated.

[0051] In some embodiments, a consistency threshold is preset. Then, the device similarity is compared with this threshold. If the device similarity is higher than or equal to the threshold, the device fingerprint characteristics before and after the MAC address change are considered consistent, constituting a genuine device identification change, and thus there is no suspicion of identity forgery. If the device similarity is lower than the threshold, it indicates that core characteristics such as the operating system, browser, encryption configuration, or hardware clock have undergone unreasonable changes, which is inconsistent with the logic of normal device upgrades or replacements. Therefore, the terminal is suspected of identity forgery, and a forgery detection result containing this determination is generated.

[0052] It should be noted that the consistency threshold is determined based on statistical experience of characteristic fluctuations in a large number of real devices during normal configuration changes (such as system updates).

[0053] By performing identity forgery detection on terminals with stable behavior, it is possible to effectively identify terminals that may have been hijacked and misused but whose behavior is disguised as normal, thus making up for the blind spots of simple behavior analysis and significantly reducing the false negative rate.

[0054] In some embodiments, the forgery detection result includes a legitimate conversion device and an identity forgery device. The step of combining the access mutation terminal and the forgery detection result to determine the compromised terminal set in the network through a preset association judgment rule includes: determining, based on the address change records, a first address change state corresponding to the access mutation terminal and a second address change state corresponding to the identity forgery device; if the first address change state is fixed or if the second address change state is changing, then the corresponding access mutation terminal and the identity forgery device are added to the compromised terminal set. Specifically, firstly, for each access mutation terminal, its address change records within a preset observation period are queried. If the records show that the terminal's MAC address has never changed during this period, its first address change state is determined to be "fixed". Simultaneously, for each terminal suspected of identity forgery, its address change records are also queried. If the records confirm that the terminal did indeed change its MAC address during this observation period, its second address change state is determined to be "changing". Subsequently, the pre-defined association judgment rules are applied: as long as the first address change state of a terminal with a sudden access mutation is "fixed", it indicates that the terminal has undergone an abnormal change in its access behavior pattern while maintaining the same physical identity. This is highly consistent with the characteristics of the device being controlled (such as becoming a zombie terminal), so it is added to the compromised terminal set. Similarly, as long as the second address change state of a terminal suspected of identity forgery is "change", it indicates that an entity is deliberately changing the hardware identifier while also forging the device fingerprint. This usually points to active deception and infiltration behavior, so it is also added to the compromised terminal set.

[0055] By combining two different types of suspicious clues, "behavioral mutation" and "identity forgery," with the network layer fact of terminal address change records for correlation judgment, a set of compromised terminals is constructed. This rule integrates behavioral anomalies and identity credibility, which greatly improves the accuracy of the judgment results and effectively avoids false alarms from single indicators.

[0056] Step S103: Obtain the port transmission volume corresponding to each terminal in the compromised terminal set, and analyze the cross-network segment access frequency and the number of unconventional port connections of the content within a preset time period based on the port transmission volume. If the cross-network segment access frequency and the number of unconventional port connections meet the preset conditions, then identify the threat terminal with lateral movement behavior and isolate the threat terminal from the network.

[0057] In some embodiments, the port transmission volume corresponding to each terminal in the compromised terminal set is obtained. Specifically, firstly, based on the MAC address of each terminal in the determined compromised terminal set, the physical switch port currently or historically connected to is queried in the network device management system. Subsequently, the switch's MIB (Management Information Base) is accessed via SNMP (Simple Network Management Protocol) to read the inbound byte count counter (ifInOctets) and outbound byte count counter (ifOutOctets) of the specified port object in real time. The system polls and collects the values ​​of these two counters at fixed time intervals (e.g., every 30 seconds), and by calculating the difference between two adjacent collections, the original number of bytes transmitted bidirectionally by the port during that time period is obtained, i.e., the port transmission volume is determined.

[0058] It should be noted that port throughput refers to the total amount of network data transmitted bidirectionally through the physical switch port connected to the terminal within a preset time period, usually measured in bytes.

[0059] In some embodiments, the step of analyzing the cross-segment access frequency and the number of unconventional port connections within a preset time period based on the port transmission volume analysis includes: based on the source and destination addresses in the port transmission volume data, counting the cross-segment access frequency of each terminal in the compromised terminal set within the preset time period; based on the destination port number in the port transmission volume data, identifying unconventional ports that do not belong to a preset standard service port list within the preset time period, and counting the number of unconventional port connections within the preset time period. Specifically, firstly, the source IP address and destination IP address of each port transmission volume record are parsed; then, according to predefined network segment division rules, it is determined whether the connection crosses different logical or physical network segment boundaries. Then, all connection records of the specified terminal within a preset time period (e.g., 24 hours) are traversed, and each access determined to be cross-segment is cumulatively counted to obtain the total number of cross-segment accesses of the terminal within this time period, i.e., the cross-segment access frequency. Secondly, a pre-defined list of standard service ports is maintained, including all known port numbers required for normal business operations, such as 80 (HTTP), 443 (HTTPS), 22 (SSH), and 3306 (MySQL). When analyzing port transmission volume data within the same time period, for each connection record, the target port number is checked to see if it exists in this standard list. If the target port is not in the list, the connection is identified as an "unconventional port connection." Finally, the number of all such unconventional port connections occurring on the terminal within the pre-defined time period is counted to obtain the number of unconventional port connections.

[0060] It should be noted that the network segmentation rules, such as the office network segment being 192.168.1.0 / 24 and the server network segment being 192.168.100.0 / 24, are not limited in this application.

[0061] It should be noted that the frequency of cross-network segment access refers to the total number of network connections initiated by the terminal within a preset time period, where the source IP address and destination IP address belong to different predefined network segments. This indicator is used to quantify the terminal's activity in probing or accessing other logical areas of the internal network. The number of non-standard port connections refers to the total number of network connections initiated by the terminal within a preset time period, where the destination port number does not belong to the preset standard service port list. This indicator is used to identify possible covert communication, vulnerability exploitation, or unauthorized service access behaviors by the terminal.

[0062] By analyzing two key behavioral indicators, "frequency of cross-network segment access" and "number of connections to unconventional ports," this approach accurately captures the typical lateral movement and covert communication characteristics of attackers after gaining control of the terminal. This allows for further differentiation of the "suspicious terminal set" selected in the previous steps into general abnormal terminals and high-risk "threat terminals," greatly improving the accuracy of the final isolation target. It ensures that automated isolation actions are precisely applied to terminals that are carrying out internal network penetration, avoiding false isolation.

[0063] In some embodiments, determining a threat terminal exhibiting lateral movement behavior if the cross-network segment access frequency and the number of unconventional port connections meet preset conditions includes: if the cross-network segment access frequency corresponding to any terminal in the compromised terminal set is greater than or equal to a preset first threshold, and the number of unconventional port connections shows a continuous increase within multiple consecutive observation windows, then the corresponding terminal is determined to meet the preset conditions, and the corresponding terminal is identified as a threat terminal exhibiting lateral movement behavior. Specifically, firstly, the cross-network segment access frequency of the terminal within a preset time period (e.g., 24 hours) is compared with a preset first threshold. Secondly, trend analysis is performed on the unconventional port connection activities of the same terminal within the same time period: that is, the total duration is divided into a series of consecutive, equally long observation windows (e.g., one window per hour), and the number of unconventional port connections occurring within each window is calculated, thereby forming a time sequence of connection counts. By comparing the values ​​of adjacent windows, if the number of connections in multiple consecutive (e.g., three) windows is strictly higher than the value of the previous window, it is determined that the behavior shows a "continuous growth" trend. Ultimately, only when a terminal simultaneously meets both the conditions of "cross-network segment access frequency greater than or equal to the first threshold" and "the number of connections to unconventional ports shows a continuous upward trend" will its network activity be comprehensively identified as having the typical characteristics of lateral reconnaissance and penetration within the internal network, thus determining that the terminal meets the preset threat conditions.

[0064] It should be noted that the first threshold is not a fixed value, but is dynamically determined by analyzing the baseline behavior of a large number of terminals during the normal operation of the enterprise network in history. For example, it is usually set to three times the average daily number of cross-network segment accesses of all terminals in history.

[0065] By analyzing the cross-segment access frequency and unconventional port connection behavior in the port traffic of each port of the compromised terminal, it is possible to accurately identify the threat terminals that are carrying out substantial penetration and spread from suspicious terminals, making the isolation target clearer.

[0066] In some embodiments, network isolation of the threat terminal includes: querying the physical port of the network switch to which the threat terminal is connected based on its Media Access Control (MAC) address; sending a configuration command to the network switch to migrate the virtual local area network (VLAN) to which the physical port belongs from the service VLAN to the isolation VLAN; and adding a denial rule with the MAC address as the source address to the access control list of the network switch. Specifically, firstly, the physical switch port number corresponding to the address is precisely matched by querying the switch's address forwarding table or MAC address table. Subsequently, the system sends two consecutive configuration commands to the switch via the SNMP protocol or by directly calling the switch's command-line interface. The first command is used to modify the VLAN affiliation of the port, and the specific command format is usually "switchport access vlan [isolation VLAN number]". This operation immediately migrates the threat terminal from its original service VLAN (such as VLAN 10) to a pre-configured isolation VLAN (such as VLAN 999). This isolation VLAN is designed as a logically isolated area with no routing exit and only allows communication with the log server. The second instruction creates a deny rule in the switch's access control list. This rule denies forwarding any data frames whose source address is the media access control address of the threatening endpoint. This rule is typically given high priority and applied to all inbound ports. This ensures that the threatening endpoint is blocked at both the data link layer and the network access layer, thereby suppressing any further network activity.

[0067] By performing automated isolation operations based on network switches on threat terminals confirmed to exhibit lateral movement behavior, the attack chain can be quickly cut off, the threat spread can be prevented, and a security closed loop from accurate identification to automatic handling can be achieved.

[0068] This invention, by collecting and comparing terminal resource type access logs with historical behavior baselines, can keenly capture abnormal changes in behavioral patterns and quickly filter out suspicious "access mutation terminals," providing a first-level clue for early threat detection. By performing identity spoofing detection on terminals with stable behavior, it can effectively identify terminals that may have been hijacked and impersonated but whose behavior is disguised as normal, filling the blind spots of simple behavioral analysis and significantly reducing the false negative rate. Furthermore, by combining these two different dimensions of suspicious clues—"behavioral mutation" and "identity spoofing"—with the network layer fact of terminal address change records for correlation judgment, it establishes a comprehensive understanding of the underlying threats. A compromised endpoint set was constructed, and the rule combining behavioral anomalies and identity credibility greatly improves the accuracy of the judgment results and effectively avoids false alarms from single indicators. By analyzing the cross-segment access frequency and abnormal port connection behavior in the port transmission volume of each port in the compromised endpoint set, the threat endpoints that are carrying out substantial penetration and spread can be accurately identified from suspicious endpoints, making the isolation targets clearer. By performing automated isolation operations based on network switches on threat endpoints confirmed to have lateral movement behavior, the attack chain can be quickly cut off to prevent the threat from spreading, realizing a security closed loop from accurate identification to automatic handling.

[0069] like Figure 4 As shown, based on the above method embodiments, corresponding apparatus embodiments are provided; One embodiment of the present invention provides an isolation system for network threat terminals, comprising: The acquisition module 100 is used to collect address change records and resource type access logs of each terminal from the network access point; The judgment module 200 is used to compare the current access behavior of each terminal with the historical behavior baseline vector according to the resource type access log to identify access mutation terminals and access stable terminals, perform identity forgery detection on the access stable terminals to obtain forgery detection results, and combine the access mutation terminals and the forgery detection results to determine the set of compromised terminals in the network through preset association judgment rules. In some embodiments, the determining module 200 includes a first processing unit, the first processing unit comprising: The first processing subunit is used to calculate the first proportion of access times of various types of resources based on the historical resource type access logs of each terminal, and to construct the historical behavior baseline vector of each terminal based on the first proportion. The second processing subunit is used to calculate the second proportion of access times for each type of resource based on the resource type access log in the current monitoring window of each terminal, so as to construct the current behavior vector based on the second proportion; The third processing subunit is used to calculate the behavior similarity value between the current behavior vector and the historical behavior baseline vector; The fourth processing subunit is used to mark the corresponding terminal as a terminal that has experienced a sudden change in access if the behavior similarity value is lower than a preset similarity threshold, and otherwise mark it as a terminal that has experienced a stable change in access.

[0070] By collecting and comparing the resource type access logs of the terminal with the historical behavior baseline, it is possible to keenly capture abnormal changes in behavior patterns and quickly filter out suspicious "access mutation terminals", providing the first layer of clues for early threat discovery.

[0071] In some embodiments, the first processing subunit includes: Based on the current time, obtain the historical resource type access logs of all resource types for each terminal within the preset historical time period; The preset historical duration is divided into several statistical periods, and the percentage of access to various types of resources in each statistical period is calculated as the percentage of the total number of accesses in the corresponding period. The first proportion is obtained by averaging the proportions of the cycles.

[0072] In some embodiments, the determining module 200 includes a second processing unit, the second processing unit comprising: Obtain the first communication characteristic data of the stable access terminal at the first moment and the second communication characteristic data at the second moment; Device features of a preset dimension are extracted from the first communication feature data and the second communication feature data respectively to construct a first device feature vector and a second device feature vector; Calculate the device similarity between the first device feature vector and the second device feature vector; If the device similarity is lower than a preset consistency threshold, the corresponding terminal is suspected of identity forgery, and a forgery detection result is generated.

[0073] By performing identity forgery detection on terminals with stable behavior, it is possible to effectively identify terminals that may have been hijacked and misused but whose behavior is disguised as normal, thus making up for the blind spots of simple behavior analysis and significantly reducing the false negative rate.

[0074] In some embodiments, the determination module 200 includes a third processing unit, which includes: Based on the address change records, the first address change state corresponding to the access mutation terminal and the second address change state corresponding to the identity forgery device are determined respectively. If the first address change state is fixed or if the second address change state is changing, then the corresponding access mutation terminal and the identity forgery device are added to the compromise terminal set.

[0075] By combining two different types of suspicious clues, "behavioral mutation" and "identity forgery," with the network layer fact of terminal address change records for correlation judgment, a set of compromised terminals is constructed. This rule integrates behavioral anomalies and identity credibility, which greatly improves the accuracy of the judgment results and effectively avoids false alarms from single indicators.

[0076] The isolation module 300 is used to obtain the port transmission volume corresponding to each terminal in the compromised terminal set, and analyze the cross-network segment access frequency and the number of unconventional port connections of the content within a preset time period based on the port transmission volume. If the cross-network segment access frequency and the number of unconventional port connections meet preset conditions, then the threat terminal with lateral movement behavior is identified, and the threat terminal is isolated from the network.

[0077] In some embodiments, the isolation module 300 includes a fourth processing unit, which includes: Based on the source address and destination address in the port transmission data; The frequency of cross-network segment accesses by each terminal in the compromised terminal set within the preset time period is statistically analyzed. Based on the target port number in the port transmission data; Identify non-standard ports whose target port number does not belong to the preset standard service port list within the preset time period; The number of times the unconventional port connection occurred within the preset time period is counted.

[0078] By analyzing two key behavioral indicators, "frequency of cross-network segment access" and "number of connections to unconventional ports," this approach accurately captures the typical lateral movement and covert communication characteristics of attackers after gaining control of the terminal. This allows for further differentiation of the "suspicious terminal set" selected in the previous steps into general abnormal terminals and high-risk "threat terminals," greatly improving the accuracy of the final isolation target. It ensures that automated isolation actions are precisely applied to terminals that are carrying out internal network penetration, avoiding false isolation.

[0079] In some embodiments, determining a threatening terminal exhibiting lateral movement behavior if the cross-network segment access frequency and the number of unconventional port connections meet preset conditions includes: If the cross-network segment access frequency of any terminal in the compromised terminal set is greater than or equal to a preset first threshold, and the number of connections to the unconventional port shows a continuous increase within multiple consecutive observation windows, then the corresponding terminal is determined to meet the preset condition. The corresponding terminal was identified as a threat terminal exhibiting lateral movement behavior.

[0080] By analyzing the cross-segment access frequency and unconventional port connection behavior in the port traffic of each port of the compromised terminal, it is possible to accurately identify the threat terminals that are carrying out substantial penetration and spread from suspicious terminals, making the isolation target clearer.

[0081] In some embodiments, the isolation module 300 includes a fifth processing unit, which includes: Based on the media access control address of the threat terminal, query the physical port of the network switch it is connected to; Send a configuration command to the network switch to migrate the virtual LAN to which the physical port belongs from the service virtual LAN to the isolation virtual LAN, and add a deny rule with the media access control address as the source address to the access control list of the network switch.

[0082] By performing automated isolation operations based on network switches on threat terminals confirmed to exhibit lateral movement behavior, the attack chain can be quickly cut off, the threat spread can be prevented, and a security closed loop from accurate identification to automatic handling can be achieved.

[0083] This invention, by collecting and comparing terminal resource type access logs with historical behavior baselines, can keenly capture abnormal changes in behavioral patterns and quickly filter out suspicious "access mutation terminals," providing a first-level clue for early threat detection. By performing identity spoofing detection on terminals with stable behavior, it can effectively identify terminals that may have been hijacked and impersonated but whose behavior is disguised as normal, filling the blind spots of simple behavioral analysis and significantly reducing the false negative rate. Furthermore, by combining these two different dimensions of suspicious clues—"behavioral mutation" and "identity spoofing"—with the network layer fact of terminal address change records for correlation judgment, it establishes a comprehensive understanding of the underlying threats. A compromised endpoint set was constructed, and the rule combining behavioral anomalies and identity credibility greatly improves the accuracy of the judgment results and effectively avoids false alarms from single indicators. By analyzing the cross-segment access frequency and abnormal port connection behavior in the port transmission volume of each port in the compromised endpoint set, the threat endpoints that are carrying out substantial penetration and spread can be accurately identified from suspicious endpoints, making the isolation targets clearer. By performing automated isolation operations based on network switches on threat endpoints confirmed to have lateral movement behavior, the attack chain can be quickly cut off to prevent the threat from spreading, realizing a security closed loop from accurate identification to automatic handling.

[0084] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention, and can implement the network threat terminal isolation method provided by any of the above-described method embodiments of the present invention.

[0085] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0086] Based on the above embodiments of the network threat terminal isolation method, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the network threat terminal isolation method of any embodiment of the present invention.

[0087] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0088] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0089] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0090] In some embodiments, the processor is configured to implement: Based on the historical resource type access logs of each terminal, the first percentage of access times for each type of resource is calculated, and a historical behavior baseline vector of each terminal is constructed based on the first percentage. Based on the resource type access logs in the current monitoring window of each terminal, the second percentage of access times for each type of resource is calculated, and the current behavior vector is constructed based on the second percentage. Calculate the behavioral similarity value between the current behavior vector and the historical behavior baseline vector; If the behavioral similarity value is lower than a preset similarity threshold, the corresponding terminal will be marked as a terminal accessing a mutation terminal; otherwise, it will be marked as a terminal accessing a stable terminal.

[0091] By collecting and comparing the resource type access logs of the terminal with the historical behavior baseline, it is possible to keenly capture abnormal changes in behavior patterns and quickly filter out suspicious "access mutation terminals", providing the first layer of clues for early threat discovery.

[0092] In some embodiments, the processor is configured to implement: Based on the current time, obtain the historical resource type access logs of all resource types for each terminal within the preset historical time period; The preset historical duration is divided into several statistical periods, and the percentage of access to various types of resources in each statistical period is calculated as the percentage of the total number of accesses in the corresponding period. The first proportion is obtained by averaging the proportions of the cycles.

[0093] In some embodiments, the processor is configured to implement: Obtain the first communication characteristic data of the stable access terminal at the first moment and the second communication characteristic data at the second moment; Device features of a preset dimension are extracted from the first communication feature data and the second communication feature data respectively to construct a first device feature vector and a second device feature vector; Calculate the device similarity between the first device feature vector and the second device feature vector; If the device similarity is lower than a preset consistency threshold, the corresponding terminal is suspected of identity forgery, and a forgery detection result is generated.

[0094] By performing identity forgery detection on terminals with stable behavior, it is possible to effectively identify terminals that may have been hijacked and misused but whose behavior is disguised as normal, thus making up for the blind spots of simple behavior analysis and significantly reducing the false negative rate.

[0095] In some embodiments, the processor is configured to implement: Based on the address change records, the first address change state corresponding to the access mutation terminal and the second address change state corresponding to the identity forgery device are determined respectively. If the first address change state is fixed or if the second address change state is changing, then the corresponding access mutation terminal and the identity forgery device are added to the compromise terminal set.

[0096] By combining two different types of suspicious clues, "behavioral mutation" and "identity forgery," with the network layer fact of terminal address change records for correlation judgment, a set of compromised terminals is constructed. This rule integrates behavioral anomalies and identity credibility, which greatly improves the accuracy of the judgment results and effectively avoids false alarms from single indicators.

[0097] In some embodiments, the processor is configured to implement: Based on the source address and destination address in the port transmission data, the frequency of cross-network segment accesses of each terminal in the compromised terminal set within the preset time period is counted. Based on the target port number in the port transmission data; Identify non-standard ports whose target port number does not belong to the preset standard service port list within the preset time period; The number of times the unconventional port connection occurred within the preset time period is counted.

[0098] By analyzing two key behavioral indicators, "frequency of cross-network segment access" and "number of connections to unconventional ports," this approach accurately captures the typical lateral movement and covert communication characteristics of attackers after gaining control of the terminal. This allows for further differentiation of the "suspicious terminal set" selected in the previous steps into general abnormal terminals and high-risk "threat terminals," greatly improving the accuracy of the final isolation target. It ensures that automated isolation actions are precisely applied to terminals that are carrying out internal network penetration, avoiding false isolation.

[0099] In some embodiments, the processor is configured to implement: If the cross-network segment access frequency of any terminal in the compromised terminal set is greater than or equal to a preset first threshold, and the number of connections to the unconventional port shows a continuous increase within multiple consecutive observation windows, then the corresponding terminal is determined to meet the preset condition. The corresponding terminal was identified as a threat terminal exhibiting lateral movement behavior.

[0100] By analyzing the cross-segment access frequency and unconventional port connection behavior in the port traffic of each port of the compromised terminal, it is possible to accurately identify the threat terminals that are carrying out substantial penetration and spread from suspicious terminals, making the isolation target clearer.

[0101] In some embodiments, the processor is configured to implement: Based on the media access control address of the threat terminal, query the physical port of the network switch it is connected to; Send a configuration command to the network switch to migrate the virtual LAN to which the physical port belongs from the service virtual LAN to the isolation virtual LAN, and add a deny rule with the media access control address as the source address to the access control list of the network switch.

[0102] Based on the above-described method embodiments, another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the network threat terminal isolation method described in any of the above-described method embodiments of the present invention.

[0103] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0104] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for isolating network threat terminals, characterized in that, include: Collect address change records and resource type access logs from each terminal at the network access point; Based on the access logs of the resource type, the current access behavior of each terminal is compared with the historical behavior baseline vector to identify terminals with sudden access changes and terminals with stable access. Identity spoofing detection is performed on the stable access terminals to obtain spoofing detection results. Combining the terminals with sudden access changes and the spoofing detection results, the set of compromised terminals in the network is determined by a preset association judgment rule. The system obtains the port transmission volume corresponding to each terminal in the compromised terminal set, and analyzes the cross-network segment access frequency and the number of unconventional port connections for a preset time period based on the port transmission volume. If the cross-network segment access frequency and the number of unconventional port connections meet preset conditions, the system determines the threat terminal with lateral movement behavior and isolates the threat terminal from the network.

2. The method for isolating network threat terminals according to claim 1, characterized in that, The step of comparing the current access behavior of each terminal with the historical behavior baseline vector based on the access logs of the resource type to identify terminals with sudden access changes and terminals with stable access includes: Based on the historical resource type access logs of each terminal, the first percentage of access times for each type of resource is calculated, and a historical behavior baseline vector of each terminal is constructed based on the first percentage. Based on the resource type access logs in the current monitoring window of each terminal, the second percentage of access times for each type of resource is calculated, and the current behavior vector is constructed based on the second percentage. Calculate the behavioral similarity value between the current behavior vector and the historical behavior baseline vector; If the behavioral similarity value is lower than a preset similarity threshold, the corresponding terminal will be marked as a terminal accessing a mutation terminal; otherwise, it will be marked as a terminal accessing a stable terminal.

3. The method for isolating network threat terminals according to claim 2, characterized in that, The first percentage of access times for each type of resource is calculated based on the historical resource type access logs of each terminal, including: Based on the current time, obtain the historical resource type access logs of all resource types for each terminal within the preset historical time period; The preset historical duration is divided into several statistical periods, and the percentage of access to various types of resources in each statistical period is calculated as the percentage of the total number of accesses in the corresponding period. The first proportion is obtained by averaging the proportions of the cycles.

4. The method for isolating network threat terminals according to claim 1, characterized in that, The step of performing identity spoofing detection on the stable access terminal to obtain spoofing detection results includes: Obtain the first communication characteristic data of the stable access terminal at the first moment and the second communication characteristic data at the second moment; Device features of a preset dimension are extracted from the first communication feature data and the second communication feature data respectively to construct a first device feature vector and a second device feature vector; Calculate the device similarity between the first device feature vector and the second device feature vector; If the device similarity is lower than a preset consistency threshold, the corresponding terminal is suspected of identity forgery, and a forgery detection result is generated.

5. The method for isolating network threat terminals according to claim 1, characterized in that, The forgery detection results include legitimate conversion devices and identity forgery devices. The step of combining the access mutation terminal and the forgery detection results to determine the set of compromised terminals in the network through preset association judgment rules includes: Based on the address change records, the first address change state corresponding to the access mutation terminal and the second address change state corresponding to the identity forgery device are determined respectively. If the first address change state is fixed or if the second address change state is changing, then the corresponding access mutation terminal and the identity forgery device are added to the compromise terminal set.

6. The method for isolating network threat terminals according to claim 1, characterized in that, The analysis of cross-segment access frequency and non-standard port connection counts based on the transmission volume of each port within a preset time period includes: Based on the source address and destination address in the port transmission data, the frequency of cross-network segment accesses of each terminal in the compromised terminal set within the preset time period is counted. Based on the target port number in the port transmission data, identify non-standard ports that do not belong to the preset standard service port list within the preset time period, and count the number of non-standard port connections that occur within the preset time period.

7. The method for isolating network threat terminals according to claim 6, characterized in that, If the frequency of cross-network segment access and the number of connections to unconventional ports meet preset conditions, then a threatening terminal exhibiting lateral movement behavior is identified, including: If the cross-network segment access frequency of any terminal in the compromised terminal set is greater than or equal to a preset first threshold, and the number of connections to the unconventional port shows a continuous increase within multiple consecutive observation windows, then the corresponding terminal is determined to meet the preset conditions, and the corresponding terminal is identified as a threat terminal with lateral movement behavior.

8. The method for isolating network threat terminals according to claim 1, characterized in that, The network isolation of the threatened terminal includes: Based on the media access control address of the threat terminal, query the physical port of the network switch it is connected to; Send a configuration command to the network switch to migrate the virtual LAN to which the physical port belongs from the service virtual LAN to the isolation virtual LAN, and add a deny rule with the media access control address as the source address to the access control list of the network switch.

9. An isolation system for network threat terminals, characterized in that, include; The data acquisition module is used to collect address change records and resource type access logs from each terminal at the network access point. The judgment module is used to compare the current access behavior of each terminal with the historical behavior baseline vector according to the access log of the resource type to identify terminals with sudden access changes and terminals with stable access. The stable access terminals are subjected to identity forgery detection to obtain forgery detection results. The combination of the terminals with sudden access changes and the forgery detection results is used to determine the set of compromised terminals in the network through preset association judgment rules. The isolation module is used to obtain the port transmission volume corresponding to each terminal in the compromised terminal set, and analyze the cross-network segment access frequency and the number of unconventional port connections of the content within a preset time period based on the port transmission volume. If the cross-network segment access frequency and the number of unconventional port connections meet preset conditions, the threat terminal with lateral movement behavior is identified, and the threat terminal is isolated from the network.

10. A terminal device, characterized in that, include: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method for isolating network threat endpoints as described in any one of claims 1-8.

Images