Network boundary-oriented global service attack integrated protection platform

Abstract

The application discloses a kind of global service attack integrated protection platform for network boundary, including general control module, service proxy module, traffic engine module, security plug-in module and external proxy client module.General control module constructs basic communication feature pool and high-risk vulnerability decoy pool, extracts feature subset according to period and generates dynamic intrusion detection mark;Service proxy module intercepts terminal message, replaces target address and port according to feature subset and embeds dynamic intrusion detection mark in protocol header;Traffic engine module takes over inbound message in stateless mode and performs local intrusion feature hash comparison operation, consistent comparison is transmitted to internal network, inconsistent triggers intrusion detection process to compare decoy feature subset, when miss, in data link layer, silence discarding, when hit, call security plug-in module to generate false response message in combination with hardware acceleration module.The application identifies intrusion attempt through dynamic identification mechanism, realizes system-level intrusion detection and efficient attack trapping.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an integrated protection platform for network boundary-oriented, full-domain business attacks. Background Technology

[0002] With the popularization of network information technology, the business systems of enterprises and institutions are gradually opening up to the entire network. In network security confrontation, the full-domain business attack protection platform, as a network boundary barrier to resist external threats, is responsible for monitoring, analyzing and blocking access traffic targeting internal network assets.

[0003] Existing network security solutions typically employ static boundary isolation and rule-based matching mechanisms to protect internal business systems. Current defense systems primarily rely on firewalls, intrusion detection devices, and network address translation gateways to map the real network addresses and communication ports of internal business nodes to a fixed public network exit point. During data transmission, the system passively parses and filters network packets flowing into the boundary based on pre-configured access control policies or static signature databases to maintain normal communication.

[0004] However, in existing technologies, the network fingerprints of internal business assets are statically exposed during external communications, lacking dynamic identity verification mechanisms in the communication links. External attackers can easily detect and obtain the fixed network access characteristics of internal core business nodes through conventional full-network scanning methods. Because business assets lack the ability to dynamically hide themselves during operation, once network fingerprints are exposed, attackers can directly launch targeted probing and persistent attacks based on these fixed network addresses. This prevents existing protection systems from effectively blocking malicious attack chains in the early scanning and reconnaissance phase. Furthermore, existing intrusion detection systems largely rely on static rule matching and perimeter firewall log analysis, lacking the ability to dynamically compare intrusion characteristics against system-level access behavior. When external attackers obtain the network fingerprints of internal business nodes through targeted probing, existing technologies struggle to detect intrusion attempts in real time and execute local silent blocking in the early stages of the attack, preventing the protection system from effectively identifying and intercepting persistent intrusion behavior during the scanning and reconnaissance phase. Summary of the Invention

[0005] To address the problems mentioned in the background art, this invention provides an integrated protection platform for network boundary-oriented, full-domain service attacks, comprising:

[0006] The central control module is used to construct a basic communication feature pool and a high-risk vulnerability decoy pool, extract a subset of communication features and a subset of decoy features according to a time period, calculate and generate a dynamic intrusion detection identifier, and synchronize the subset of communication features, the subset of decoy features and the dynamic intrusion detection identifier to the business agent module and the traffic engine module, and synchronize the subset of communication features and the dynamic intrusion detection identifier to the external agent client module.

[0007] The business proxy module is used to intercept the initial network request message sent by the internal business terminal, replace the target address and target port of the initial network request message according to the communication feature subset, write the dynamic intrusion detection identifier into the protocol header of the initial network request message to generate a conversion data packet, and send the conversion data packet to the network boundary.

[0008] The traffic engine module is used to receive inbound data packets at the network boundary, extract the target access features and protocol header data of the inbound data packets, extract the corresponding bit feature sequence from the locally stored communication feature subset based on the target access features as a local feature sequence, perform a local intrusion feature hash comparison operation on the local feature sequence, when the comparison result is consistent with the dynamic intrusion detection identifier in the protocol header data, the inbound data packet is determined to be a normal system access, and the inbound data packet is forwarded to the internal network; when the comparison result is inconsistent with the dynamic intrusion detection identifier in the protocol header data, the intrusion detection mechanism is triggered, the inbound data packet is determined to have an intrusion attempt, and the target access features of the inbound data packet are compared with the decoy feature subset; if the target access features do not match the decoy feature subset, the inbound data packet is discarded.

[0009] The security plugin module is used by the traffic engine module to generate a fake response message and return it to the sending end when the target access feature matches the decoy feature subset.

[0010] The external proxy client module is deployed on an external network node. It is used to receive a subset of communication features and dynamic intrusion detection identifiers synchronously issued by the central control module. When sending an access request to the traffic engine module, it writes the dynamic intrusion detection identifier into the protocol header of the access request, generates an external request data packet, and sends it to the traffic engine module.

[0011] Preferably, when constructing the basic communication feature pool and the high-risk vulnerability decoy pool, the central control module defines the basic communication feature pool as set A and the high-risk vulnerability decoy pool as set B. The central control module performs mutual exclusion verification and comparison on set A and set B. When it detects that the basic communication feature element and the high-risk decoy feature element have overlapping attributes, it deletes the high-risk decoy feature element with overlapping attributes from set B, retains the corresponding basic communication feature element in set A, and keeps the intersection of set A and set B as an empty set.

[0012] Preferably, the central control module continuously receives network traffic logs reported by the traffic engine module, performs panoramic situational multi-dimensional analysis, and extracts asset activity status parameters from the network traffic logs; when the asset activity status parameters indicate that the internal business node has no network interaction records within a preset time period, the central control module determines that the internal business node is in a disabled state and deletes the basic communication feature elements corresponding to the disabled internal business node from set A.

[0013] Preferably, the central control module obtains the system load parameters and security protection level for the current time period; the central control module queries the built-in feature extraction mapping matrix to obtain the extraction quantity ratio; when the system load parameters are higher than the preset load threshold, the extraction quantity ratio is reduced; when the security protection level is increased, the extraction quantity ratio is increased; the central control module multiplies the extraction quantity ratio by the total number of basic communication feature elements and the total number of high-risk decoy feature elements respectively and rounds down to determine the number of communication features extracted from set A and the number of decoy features extracted from set B.

[0014] Preferably, the central control module extracts the system clock parameters of the current time period and converts them into a fixed-length timestamp factor; the central control module performs a high-bit zero-padding alignment operation on the bit feature sequence generated by the serialization operation of the communication feature subset, the timestamp factor, and the preset private salt value, so that the three have the same data length; the central control module performs a bitwise XOR operation on the bit feature sequence, timestamp factor, and private salt value after the high-bit zero-padding alignment operation to generate a combined verification sequence, and calls a one-way hash algorithm to perform an encrypted hash operation on the combined verification sequence to output a dynamic intrusion detection identifier.

[0015] Preferably, the service proxy module determines the embedding channel of the dynamic intrusion detection identifier based on the parsed network layer protocol identifier and application layer protocol identifier; when the network layer protocol identifier indicates Internet Protocol version 6 and the original data packet does not contain a hop-by-hop option extension header, the service proxy module inserts a hop-by-hop option extension header between the basic header and the upper layer protocol header, modifies the value of the next header field of the basic header, and divides the dynamic intrusion detection identifier into fixed-length data blocks and writes them into the type length value field of the hop-by-hop option extension header.

[0016] Preferably, the traffic engine module disables the concurrent connection tracking mechanism of the underlying network protocol stack; the traffic engine module concatenates the extracted target Internet Protocol address and target Transmission Control Protocol port number according to a preset bit order to generate a target access feature sequence, extracts the corresponding bit feature sequence from the locally stored communication feature subset based on the target access feature sequence as a local feature sequence, performs a bitwise XOR operation on the local feature sequence after high-bit zero padding length alignment, timestamp factor and private salt value, and calls the local one-way hash algorithm to perform a hash operation on the output result of the bitwise XOR operation to generate a local intrusion feature comparison result.

[0017] Preferably, when the hash comparison result indicates that the local intrusion feature comparison result is consistent with the dynamic intrusion detection identifier in the protocol header data, the traffic engine module determines that the inbound data packet originates from a legitimate business agent module or external agent client module, strips the protocol extension header in the inbound data packet and deletes the carried dynamic intrusion detection identifier; the traffic engine module reads the global static address mapping table that records static mapping relationships synchronously issued by the central control module, and restores the target Internet Protocol address and target Transmission Control Protocol port number to the target Internet Protocol address and target Transmission Control Protocol port number of the internal business terminal according to the global static address mapping table.

[0018] Preferably, when the target access feature does not match any element in the decoy feature subset, the traffic engine module determines that the inbound data packet belongs to indiscriminate scanning intrusion traffic; the traffic engine module releases the data frame buffer corresponding to the abnormal inbound data packet at the data link layer, and by truncating the network data flow at the data link layer, it bypasses the network layer protocol stack processing flow of the operating system and prevents the operating system from generating error echo messages of the Internet Control Message Protocol.

[0019] Preferably, the platform further includes a hardware acceleration module, which is internally configured with a field-programmable gate array (FPGA) logic unit. After completing the cross-substitution operation of the destination address and source address of the response message, the security plug-in module extracts the destination address field, the source address field, and the protocol identifier to generate a transport layer pseudo-header and transmits it to the hardware acceleration module. The hardware acceleration module reads the transport layer pseudo-header through the FPGA logic unit, executes a hardware-level verification algorithm to calculate and write the network layer header checksum and the transport layer header checksum, generates a fake response data packet, and sends it to the external network boundary.

[0020] The present invention, by adopting the above technical solution, can bring the following beneficial effects:

[0021] 1. This invention extracts feature subsets and generates dynamic intrusion detection identifiers by a central control module at time intervals. Combined with the business proxy module, it intercepts request packets on the boundary link. Based on the communication feature subsets, it dynamically replaces the target address and transmission port of the data packets and embeds the intrusion detection identifiers into the protocol header. The traffic engine module identifies abnormal system access in real time based on local intrusion feature hash comparison. This achieves early detection of intrusion attempts and real-time blocking of targeted probing behaviors, making it difficult for external attackers to locate internal core business nodes through conventional full network scanning methods, thus improving the response efficiency of system-level intrusion detection.

[0022] 2. This invention disables the underlying protocol stack concurrent connection tracking mechanism through the traffic engine module and takes over inbound data packets without allocating session state storage space. It extracts target access features and performs local intrusion feature hash comparison. When an intrusion attempt is detected, it directly releases the data frame buffer at the data link layer, achieving silent blocking of system-level intrusion behavior. This effectively avoids the operating system network layer processing flow and prevents the system from generating error echo messages, significantly reducing the risk of protocol stack resource exhaustion caused by massive concurrent probes.

[0023] 3. This invention extracts the spoofing template and performs address and port cross-replacement when the intrusion traffic features hit the decoy feature subset through the security plug-in module. Combined with the field-programmable gate array logic unit built into the hardware acceleration module to read the transport layer pseudo header and execute the hardware-level verification algorithm, it realizes high-speed calculation and fast encapsulation and sending of the header checksum of the fake response data packet. Thus, while inducing external attackers to fall into fake business logic and delaying their attack pace, it alleviates the CPU performance bottleneck caused by software operation in the large-scale fake response construction process. Attached Figure Description

[0024] Figure 1 This is a system architecture diagram of the present invention;

[0025] Figure 2 This is a flowchart illustrating the overall workflow for comprehensive business attack protection in this invention.

[0026] Figure 3 This is a flowchart of the feature pool construction process of the present invention;

[0027] Figure 4 This is a flowchart illustrating the dynamic update process of the resource pool in this invention.

[0028] Figure 5 This is a flowchart of the feature subset extraction process of the present invention;

[0029] Figure 6 This is a flowchart of the dynamic intrusion detection identifier calculation process of the present invention;

[0030] Figure 7 This is a flowchart of the traffic takeover and feature replacement process of the present invention;

[0031] Figure 8 This is a flowchart illustrating the protocol escape handling process of this invention;

[0032] Figure 9 This is a flowchart of the state-free parsing and recalculation process of the present invention;

[0033] Figure 10 This is a flowchart of the Boolean routing determination and traffic pass-through process of the present invention;

[0034] Figure 11 This is a flowchart of the illegal traffic filtering process of the present invention;

[0035] Figure 12 This is a flowchart of the hardware-accelerated camouflage construction process of the present invention. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Example 1

[0038] Please refer to the appendix. Figure 1 This invention provides an integrated protection platform for network boundary-oriented full-domain business attacks, including a central control module 10, a business proxy module 20, a traffic engine module 30, and a security plug-in module 40.

[0039] The central control module 10 is deployed on the management and control network. The communication interface of the central control module 10 is connected to the business agent module 20 and the traffic engine module 30 respectively to establish an encrypted communication control channel.

[0040] The service proxy module 20 is deployed in series between the internal service terminal and the border network. The traffic input end of the service proxy module 20 is connected to the internal service terminal, and the traffic output end of the service proxy module 20 is connected to the traffic engine module 30.

[0041] The traffic engine module 30 is deployed at the boundary of the global network. The external network interface of the traffic engine module 30 is connected to the external network, and the internal network interface of the traffic engine module 30 is connected to the internal business nodes and the business proxy module 20.

[0042] The security plug-in module 40 is deployed inside the traffic engine module 30 as an embedded component and establishes a call connection with the underlying forwarding bus of the traffic engine module 30.

[0043] The external agent client module 60 is deployed on an external network node. The communication interface of the external agent client module 60 establishes an encrypted communication control channel with the central control module 10. The external agent client module 60 receives the communication feature subset and dynamic intrusion detection identifier synchronously issued by the central control module 10. The traffic output end of the external agent client module 60 is connected to the external network interface of the traffic engine module 30.

[0044] Example 2

[0045] Please refer to the appendix. Figure 2 Based on Embodiment 1, the aforementioned integrated protection platform for network boundary-oriented full-domain service attacks achieves integrated protection against full-domain service attacks through the coordinated cooperation of various modules. This protection process includes an outbound traffic processing process and an inbound traffic verification process. The outbound traffic processing process is executed by the service proxy module 20, and the inbound traffic verification process is executed by the traffic engine module 30. Specifically, it includes the following steps:

[0046] In step S100, the central control module 10 constructs a basic communication feature pool and a high-risk vulnerability decoy pool. The central control module 10 extracts a subset of communication features and a subset of decoy features according to a time period. The central control module 10 calculates and generates a dynamic intrusion detection identifier. The central control module 10 synchronizes the subset of communication features, the subset of decoy features, and the dynamic intrusion detection identifier to the business agent module 20 and the traffic engine module 30, and synchronizes the subset of communication features and the dynamic intrusion detection identifier to the external agent client module 60.

[0047] In step S200, the service proxy module 20 intercepts the initial network request message sent by the internal service terminal. The service proxy module 20 replaces the target address and target port of the initial network request message according to the communication feature subset. The service proxy module 20 writes the dynamic intrusion detection identifier into the protocol header of the initial network request message to generate a conversion data packet. The service proxy module 20 sends the conversion data packet to the network boundary.

[0048] In step S300, the traffic engine module 30 receives inbound data packets from the network boundary. The traffic engine module 30 extracts the target access features and protocol header data of the inbound data packets. Based on the target access features, the traffic engine module 30 extracts the corresponding bit feature sequence from the locally stored communication feature subset as a local feature sequence. The local feature sequence is subjected to a local intrusion feature hash comparison operation. When the comparison result is consistent with the dynamic intrusion detection identifier in the protocol header data, the traffic engine module 30 forwards the inbound data packets to the internal network.

[0049] In step S400, when the comparison result is inconsistent with the protocol header data, the traffic engine module 30 triggers the intrusion detection mechanism, determines that the inbound data packet has an intrusion attempt, and compares the target access feature of the inbound data packet with the decoy feature subset. If the target access feature does not match the decoy feature subset, the traffic engine module 30 discards the inbound data packet. If the target access feature matches the decoy feature subset, the traffic engine module 30 calls the security plug-in module 40 to generate a false response message and returns it to the sending end.

[0050] Example 3

[0051] Please refer to the appendix. Figure 3 and attached Figure 4 Based on Embodiment 1 and Embodiment 2, in order to construct the basic communication feature pool and the high-risk vulnerability decoy pool in S100, and further realize the dynamic updating of the resource pool, the central control module 10 performs the following operations:

[0052] Step S100-1: The central control module 10 scans the application assets, application programming interface assets and database assets of the internal network. The central control module 10 obtains the network communication attributes of active business nodes in the internal network. The central control module 10 extracts the valid transmission control protocol port number, uniform resource identifier path and application layer header field of the active business nodes. The central control module 10 defines the valid transmission control protocol port number, uniform resource identifier path and application layer header field as basic communication characteristics.

[0053] Step S100-2: The central control module 10 summarizes the basic communication features to construct a basic communication feature pool. The central control module 10 defines the basic communication feature pool as set A, which contains M basic communication feature elements, where M is a natural number greater than zero.

[0054] Step S100-3: The central control module 10 receives external threat intelligence data and reads the historical interception logs of the network boundary. The central control module 10 extracts the high-frequency detection target fingerprint parameters from the external threat intelligence data and the historical interception logs of the network boundary. The central control module 10 generates fake vulnerability parameters and fake website backend paths through port spoofing and vulnerability masquerading mechanisms. The central control module 10 extracts the general vulnerability disclosure associated port, the default remote call service port, and the fake website backend path. The central control module 10 defines the general vulnerability disclosure associated port, the default remote call service port, and the fake website backend path as high-risk decoy features.

[0055] Step S100-4: The central control module 10 summarizes the high-risk decoy features to construct a high-risk vulnerability decoy pool. The central control module 10 defines the high-risk vulnerability decoy pool as set B, which contains N high-risk decoy feature elements, where N is a natural number greater than zero.

[0056] Step S100-5: The central control module 10 reads the basic communication feature elements in set A and the high-risk decoy feature elements in set B. The central control module 10 performs mutual exclusion verification and comparison on set A and set B. When the central control module 10 detects that the basic communication feature elements and the high-risk decoy feature elements have overlapping attributes, the central control module 10 deletes the high-risk decoy feature elements with overlapping attributes from set B. The central control module 10 retains the corresponding basic communication feature elements in set A and sets the intersection of set A and set B to be an empty set.

[0057] Step S100-6: The central control module 10 continuously receives network traffic logs reported by the traffic engine module 30. The central control module 10 performs panoramic situational multidimensional analysis, extracts asset activity status parameters from the network traffic logs, and compares the asset activity status parameters with the basic communication feature elements in set A.

[0058] Step S100-7: When the asset activity status parameter indicates that the internal business node has no network interaction record within a preset time period, the central control module 10 determines that the internal business node is in a disabled state. The central control module 10 deletes the basic communication feature element corresponding to the disabled internal business node from set A. When the central control module 10 discovers a new application programming interface asset through panoramic situational multidimensional analysis, the central control module 10 extracts the access protocol parameter of the new asset and writes the access protocol parameter as a basic communication feature element into set A.

[0059] Step S100-8: The central control module 10 establishes a data connection with the external third-party asset center to obtain updated threat intelligence. The central control module 10 extracts vulnerability scanning fingerprints and malicious detection features from the threat intelligence. The central control module 10 combines the vulnerability detection service to evaluate system configuration defects and component vulnerabilities within the entire network.

[0060] Step S100-9: The central control module 10 analyzes the vulnerability scan fingerprint, malicious detection features, and system configuration defects. The central control module 10 extracts the corresponding network port number and access path. The central control module 10 formats the network port number and access path into incremental decoy parameters. The central control module 10 adds the incremental decoy parameters as high-risk decoy feature elements to set B. The central control module 10 rereads the updated set A and set B. The central control module 10 performs a mutual exclusion comparison operation on set A and set B. When overlapping features are found, the central control module 10 deletes the overlapping high-risk decoy feature elements in set B, maintaining the intersection of set A and set B as an empty set.

[0061] Please refer to the appendix. Figure 5 and attached Figure 6 To achieve the extraction of communication feature subsets and decoy feature subsets as described in step S100, as well as the generation of dynamic intrusion detection identifiers, the central control module 10 performs the following operations:

[0062] Step S100-10: The central control module 10 sets the global discrete time step. The central control module 10 divides the continuous time period according to the global discrete time step. At the beginning of the time period, the central control module 10 reads the set A corresponding to the basic communication feature pool and the set B corresponding to the high-risk vulnerability decoy pool. The central control module 10 counts the total number M of basic communication feature elements contained in set A and the total number N of high-risk decoy feature elements contained in set B.

[0063] Steps S100-11: The central control module 10 obtains the system load parameters and security protection level for the current time period. The central control module 10 has a built-in feature extraction mapping matrix, which contains the correspondence between system load parameters, security protection level and extraction quantity ratio. The central control module 10 queries the feature extraction mapping matrix to obtain the extraction quantity ratio. When the system load parameters are higher than the preset load threshold, the central control module 10 lowers the extraction quantity ratio. When the security protection level is increased, the central control module 10 raises the extraction quantity ratio. The central control module 10 multiplies the extraction quantity ratio by the total number of basic communication feature elements M and the total number of high-risk decoy feature elements N, respectively. The central control module 10 rounds down the product result to determine the number of communication features m extracted from set A and the number of decoy features n extracted from set B.

[0064] Step S100-12: The central control module 10 executes the random sampling algorithm without replacement. The central control module 10 extracts m basic communication feature elements from set A within the current time period to form a communication feature subset. The central control module 10 extracts n high-risk decoy feature elements from set B within the current time period to form a decoy feature subset.

[0065] Steps S100-13: The central control module 10 calculates the system topology display space capacity for the current time period. The central control module 10 also calculates the total number of combinations of communication feature subsets and decoy feature subsets. The formula for calculating the system topology display space capacity by the central control module 10 is as follows:

[0066]

[0067] in, This indicates the spatial capacity of the system topology. This represents the total number of basic communication characteristic elements in set A. Indicates the number of elements in the subset of communication features. This represents the total number of high-risk decoy characteristic elements in set B. This represents the number of elements in the feature subset of the decoy. and These represent the corresponding binomial combination calculation operations;

[0068] Step S100-14: The central control module 10 encapsulates the communication feature subset and the decoy feature subset into data to generate a feature subset message. The central control module 10 writes the feature subset message into the state storage area. The central control module 10 outputs the communication feature subset and the decoy feature subset to trigger the hash operation unit to perform the dynamic intrusion detection identifier generation operation.

[0069] Steps S100-15: The central control module 10 receives a subset of communication features, extracts the system clock parameters for the current time period, converts the system clock parameters into a fixed-length timestamp factor, and reads the preset private salt value.

[0070] Steps S100-16: The central control module 10 performs a serialization operation on the communication feature subset to generate a bit feature sequence. The central control module 10 performs a high-bit zero-padding alignment operation on the bit feature sequence, timestamp factor, and private salt value to make the bit feature sequence, timestamp factor, and private salt value have the same data length. The central control module 10 performs a bitwise XOR operation on the bit feature sequence, timestamp factor, and private salt value after the high-bit zero-padding alignment operation to generate a combined verification sequence.

[0071] In step S100-17, the central control module 10 calls the one-way hash algorithm to perform encrypted hashing on the combined verification sequence. The central control module 10 outputs the dynamic intrusion detection identifier for the current time period. The formula for generating the dynamic intrusion detection identifier by the central control module 10 is as follows:

[0072]

[0073] in, Indicates a dynamic intrusion detection identifier. This represents a one-way hash algorithm. Represents the bit feature sequence, Indicates timestamp factor, Indicates the privacy value. This represents the bitwise XOR operator;

[0074] In steps S100-18, the central control module 10 establishes a communication connection with the business agent module 20 and the traffic engine module 30. The central control module 10 encapsulates a subset of communication features and dynamic intrusion detection identifiers into a synchronization data packet. The central control module 10 sends the synchronization data packet to the business agent module 20, the traffic engine module 30, and the external agent client module 60. The central control module 10 writes a synchronization completion flag in the state storage area.

[0075] Further details are provided in the appendix. Figure 7 and attached Figure 8To achieve the terminal traffic takeover, feature replacement, and data packet conversion described in step S200, the service proxy module 20 performs the following operations:

[0076] Step S200-1: The service agent module 20 receives the communication feature subset and dynamic intrusion detection identifier sent by the central control module 10. The service agent module 20 intercepts the original data packets sent by the internal service terminal on the communication link between the internal service network and the global network boundary.

[0077] Step S200-2: The service proxy module 20 parses the network layer protocol header and transport layer protocol header of the original data packet, and extracts the original destination Internet Protocol address and the original destination Transmission Control Protocol port number of the original data packet.

[0078] Step S200-3: The service proxy module 20 extracts the source Internet Protocol address of the original data packet. The service proxy module 20 performs a hash modulo operation on the source Internet Protocol address. Based on the operation result, the service proxy module 20 selects the corresponding legitimate Internet Protocol address and legitimate Transmission Control Protocol (TCP) port number within the communication feature subset. The service proxy module 20 replaces the original destination Internet Protocol address of the original data packet with the selected legitimate Internet Protocol address and replaces the original destination TCP port number of the original data packet with the selected legitimate TCP port number. Through the above dynamic replacement operation of the target address and transmission port, the network fingerprint of the real business assets is dynamically hidden, making it impossible for external attackers to locate the internal core business nodes through conventional full network scanning methods.

[0079] Step S200-4: The service proxy module 20 recalculates the network layer header checksum based on the selected legitimate Internet Protocol address, and recalculates the transport layer header checksum based on the selected legitimate Transmission Control Protocol port number. The service proxy module 20 writes the network layer header checksum and the transport layer header checksum into the header check field corresponding to the original data packet, respectively. The service proxy module 20 outputs the data packet that has completed the feature replacement operation.

[0080] Step S200-5: The service agent module 20 reads the data packet after the feature replacement operation is completed. The service agent module 20 parses the network layer protocol identifier and application layer protocol identifier of the data packet after the feature replacement operation is completed. The service agent module 20 determines the embedding channel of the dynamic intrusion detection identifier based on the network layer protocol identifier and application layer protocol identifier.

[0081] Step S200-6: When the network layer protocol identifier indicates Internet Protocol version 6, the service agent module 20 checks whether the data packet that has completed the feature replacement operation contains a hop-by-hop option extension header. If it does not contain a hop-by-hop option extension header, the service agent module 20 inserts a hop-by-hop option extension header between the basic header and the upper layer protocol header. The service agent module 20 modifies the value of the next header field of the basic header. The service agent module 20 divides the dynamic intrusion detection identifier into fixed-length data blocks. The service agent module 20 writes the fixed-length data blocks into the type length value field of the hop-by-hop option extension header. The service agent module 20 recalculates the network layer checksum parameters to generate the transformed data packet.

[0082] Step S200-7: When the application layer protocol identifier indicates Hypertext Transfer Protocol, the service proxy module 20 performs application layer encapsulation operation. The service proxy module 20 adds a custom authentication header field to the application layer header of the data packet that has completed the feature replacement operation. The service proxy module 20 writes the dynamic intrusion detection identifier into the data area of ​​the custom authentication header field. The service proxy module 20 reconstructs the transport layer header byte length parameter and checksum parameter to generate a converted data packet.

[0083] In step S200-8, the service proxy module 20 outputs a converted data packet through the above-mentioned multi-channel protocol escape operation. The calculation process of the service proxy module 20 in generating the converted data packet satisfies the following formula:

[0084]

[0085] in, Indicates the conversion of data packets. This indicates a multi-level protocol embedding function. Indicates the original data packet. Represents a subset of communication features. Indicates a dynamic intrusion detection identifier;

[0086] In step S200-9, the service agent module 20 establishes an external network communication connection, sends the converted data packet to the external network boundary, and transmits the converted data packet to the traffic engine module 30, triggering a stateless hash route verification operation.

[0087] Further details are provided in the appendix. Figure 9 and attached Figure 10 To achieve the inbound data packet verification and legitimate traffic pass-through described in S300, the traffic engine module 30 performs the following operations:

[0088] Step S300-1: The traffic engine module 30 is deployed at the boundary of the global network. The traffic engine module 30 receives inbound data packets sent by the service proxy module 20 or the external proxy client module 60. The traffic engine module 30 disables the concurrent connection tracking mechanism of the underlying network protocol stack. The traffic engine module 30 takes over the inbound data packets without allocating network session state storage space. By taking over the data packets in a completely stateless mode, the risk of protocol stack resource exhaustion caused by massive concurrent probing is completely eliminated.

[0089] Step S300-2: The traffic engine module 30 parses the network layer protocol header and transport layer protocol header of the inbound data packet, extracts the target Internet Protocol address and target Transmission Control Protocol port number of the inbound data packet, and concatenates the target Internet Protocol address and target Transmission Control Protocol port number in a preset bit order to generate a target access feature sequence.

[0090] Step S300-3: The traffic engine module 30 detects whether the inbound data packet contains a protocol extension header. When the inbound data packet contains a protocol extension header, the traffic engine module 30 parses the protocol extension header and extracts the dynamic intrusion detection identifier from the protocol header data. When the inbound data packet does not contain a protocol extension header, the traffic engine module 30 assigns a preset null value to the detection identifier fragment.

[0091] Step S300-4: The traffic engine module 30 reads the private salt value synchronously issued by the central control module 10 from the local hardware status storage area, the traffic engine module 30 extracts the local clock parameters, and the traffic engine module 30 converts the local clock parameters into timestamp factors.

[0092] The traffic engine module 30 performs a traversal matching between the target access feature sequence and the locally stored communication feature subset. When the target access feature sequence matches the basic communication feature element in the communication feature subset, the traffic engine module 30 extracts the bit feature sequence of the communication feature subset as the local feature sequence. When the target access feature sequence does not match the communication feature subset, the traffic engine module 30 directly triggers the intrusion detection judgment process.

[0093] Step S300-5: The traffic engine module 30 performs a high-bit zero-padding length alignment operation on the local feature sequence, timestamp factor, and private salt value. The traffic engine module 30 performs a bitwise XOR operation on the length-aligned local feature sequence, timestamp factor, and private salt value. The traffic engine module 30 calls the local one-way hash algorithm to perform a hash operation on the output result of the bitwise XOR operation to generate a local intrusion feature comparison result.

[0094] Step S300-6: The traffic engine module 30 imports the local intrusion feature comparison result and the dynamic intrusion detection identifier in the protocol header data into the hardware comparison register. The traffic engine module 30 performs a numerical comparison operation in the hardware comparison register. The traffic engine module 30 outputs the hash comparison result of the inbound data packet. The traffic engine module 30 triggers the subsequent routing decision execution process based on the hash comparison result.

[0095] Step S300-7: The traffic engine module 30 reads the hash comparison result output by the hardware comparison register;

[0096] Step S300-8: When the hash comparison result indicates that the local intrusion feature comparison result is consistent with the detection identifier fragment, the traffic engine module 30 outputs a Boolean judgment truth value, and the traffic engine module 30 determines that the inbound data packet comes from the legitimate business agent module 20 or the external agent client module 60.

[0097] Step S300-9: The traffic engine module 30 strips the protocol extension header from the inbound data packet and deletes the dynamic intrusion detection identifier carried in the inbound data packet.

[0098] Step S300-10: The traffic engine module 30 reads the global static address mapping table, which is synchronously distributed by the central control module 10. The global static address mapping table records the static mapping relationship between the feature elements in the basic communication feature pool and the network address of the internal business terminal. Based on the global static address mapping table, the traffic engine module 30 restores the target Internet Protocol address of the inbound data packet to the destination Internet Protocol address of the internal business terminal. Based on the global static address mapping table, the traffic engine module 30 restores the target Transmission Control Protocol (TCP) port number of the inbound data packet to the destination TCP port number of the internal business terminal.

[0099] Step S300-11: The traffic engine module 30 recalculates the network layer header checksum and transport layer header checksum by combining the destination Internet Protocol address and the destination Transmission Control Protocol port number, and updates the header checksum field of the inbound data packet.

[0100] In step S300-12, the traffic engine module 30 forwards the inbound data packet with the header checksum field updated to the internal business network. The traffic engine module 30 completes the data link layer pass-through operation without recording the network session state.

[0101] Please refer to the appendix. Figure 11 and attached Figure 12 To achieve the intrusion traffic / abnormal access data filtering and fake response message generation described in step S400, the traffic engine module 30 and the security plug-in module 40 work together to perform the following operations:

[0102] Step S400-1: The traffic engine module 30 reads the hash comparison result output by the hardware comparison register. When the hash comparison result indicates that the local intrusion feature comparison result is inconsistent with the dynamic intrusion detection identifier in the protocol header data, the traffic engine module 30 outputs a Boolean judgment false value. The traffic engine module 30 triggers the intrusion detection mechanism and determines that the inbound data packet has an intrusion attempt.

[0103] Step S400-2, the traffic engine module 30 extracts the target access feature sequence of the abnormal access data. The target access feature sequence contains the target Internet Protocol address and the target Transmission Control Protocol port number of the intrusion data.

[0104] Step S400-3: The traffic engine module 30 reads the decoy feature subset stored locally. The decoy feature subset is synchronously distributed by the central control module 10. The traffic engine module 30 performs a traversal matching operation between the target access feature sequence and the elements in the decoy feature subset.

[0105] In step S400-4, when the target access feature sequence does not match any element in the decoy feature subset, the traffic engine module 30 determines that the inbound data packet belongs to indiscriminate scanning intrusion traffic. The traffic engine module 30 releases the data frame buffer corresponding to the inbound data packet at the data link layer. By truncating the network data flow at the data link layer, the traffic engine module 30 bypasses the network layer protocol stack processing flow of the operating system and prevents the operating system from generating error echo messages of the Internet Control Message Protocol. The traffic engine module 30 completes the silent filtering operation for indiscriminate scanning traffic. Through the above mechanism of releasing the buffer directly at the data link layer, the silent blocking of system-level intrusion behavior is achieved, which greatly reduces the external exposure of the system.

[0106] Step S400-5: When the target access feature sequence matches a specific element within the decoy feature subset, the traffic engine module 30 determines that the access data belongs to targeted intrusion attack traffic, and the traffic engine module 30 extracts the high-risk decoy feature attributes that trigger the matching operation.

[0107] Step S400-6: The traffic engine module 30 encapsulates the high-risk decoy feature attributes and the source network address information of the intrusion data. The traffic engine module 30 sends a wake-up command to the security plug-in module 40 through the system's internal process communication link. The security plug-in module 40 receives the wake-up command and extracts the encapsulated high-risk decoy feature attributes to prepare for the camouflage response operation.

[0108] Step S400-7: The security plug-in module 40 receives the high-risk decoy feature attributes and source network address information transmitted by the traffic engine module 30. The security plug-in module 40 parses the target transmission control protocol port number in the high-risk decoy feature attributes. The security plug-in module 40 reads the built-in port protocol mapping table. The security plug-in module 40 matches the application layer protocol type of the intrusion data in the port protocol mapping table according to the target transmission control protocol port number.

[0109] Step S400-8: Security plugin module 40 queries the locally stored fake response template library and extracts the protocol fake template corresponding to the application layer protocol type. The protocol fake template contains preset fake service banner parameters and fake response status codes.

[0110] Step S400-9: The security plug-in module 40 writes the source network address information into the destination address field of the protocol masquerading template, the security plug-in module 40 writes the destination Internet Protocol address associated with the high-risk decoy feature attributes into the source address field of the protocol masquerading template, the security plug-in module 40 completes the cross-replacement operation of the network layer address and transport layer port of the response message, and the security plug-in module 40 extracts the modified destination address field, source address field and protocol identifier to generate the transport layer pseudo header;

[0111] In step S400-10, the security plug-in module 40 transmits the protocol spoofing template and the transport layer pseudo header to the hardware acceleration module 50. The hardware acceleration module 50 is internally configured with a field-programmable gate array (FPGA) logic unit. The hardware acceleration module 50 reads the transport layer pseudo header and the protocol spoofing template through the FPGA logic unit. The hardware acceleration module 50 executes a hardware-level verification algorithm to calculate the network layer header checksum and the transport layer header checksum. By introducing the FPGA logic unit to execute the hardware-level verification algorithm, high-speed calculation of the header checksum of the fake response data packet is achieved, which effectively alleviates the CPU performance bottleneck caused by software operation during the construction of large-scale spoofed responses.

[0112] In step S400-11, the hardware acceleration module 50 writes the network layer header checksum and the transport layer header checksum into the header check field of the protocol spoofing template, respectively. The hardware acceleration module 50 encapsulates the protocol spoofing template with the header check field written in it, generates a fake response data packet, and sends the fake response data packet to the external network boundary through the underlying network communication interface.

Claims

1. A comprehensive network boundary attack protection platform, characterized in that, include: The central control module (10) is used to construct a basic communication feature pool and a high-risk vulnerability decoy pool, extract a subset of communication features and a subset of decoy features according to a time period, calculate and generate a dynamic intrusion detection identifier, and synchronize the subset of communication features, the subset of decoy features and the dynamic intrusion detection identifier to the business agent module (20) and the traffic engine module (30), and synchronize the subset of communication features and the dynamic intrusion detection identifier to the external agent client module (60); The business proxy module (20) is used to intercept the initial network request message sent by the internal business terminal, replace the target address and target port of the initial network request message according to the communication feature subset, write the dynamic intrusion detection identifier into the protocol header of the initial network request message to generate a conversion data packet, and send the conversion data packet to the external network boundary. The traffic engine module (30) is used to receive inbound data packets at the network boundary, extract the target access features and protocol header data of the inbound data packets, extract the corresponding bit feature sequence from the locally stored communication feature subset based on the target access features as a local feature sequence, perform a local intrusion feature hash comparison operation on the local feature sequence, and determine that the inbound data packet is a normal system access when the comparison result is consistent with the dynamic intrusion detection identifier in the protocol header data, and forward the inbound data packet to the internal network; when the comparison result is inconsistent with the dynamic intrusion detection identifier in the protocol header data, trigger the intrusion detection mechanism, determine that the inbound data packet has an intrusion attempt, and compare the target access features of the inbound data packet with the decoy feature subset. If the target access features do not match the decoy feature subset, discard the inbound data packet. The security plug-in module (40) is used to generate a false response message and return it to the sending end when the target access feature hits the decoy feature subset; The external proxy client module (60) is deployed on an external network node to receive the communication feature subset and dynamic intrusion detection identifier synchronously issued by the central control module (10). When sending an access request to the traffic engine module (30), the dynamic intrusion detection identifier is written into the protocol header of the access request, generating an external request data packet and sending it to the traffic engine module (30).

2. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, When constructing the basic communication feature pool and the high-risk vulnerability decoy pool, the overall control module (10) defines the basic communication feature pool as set A and the high-risk vulnerability decoy pool as set B. The overall control module (10) performs mutual exclusion verification and comparison on set A and set B. When it detects that the basic communication feature element and the high-risk decoy feature element have overlapping attributes, it deletes the high-risk decoy feature element with overlapping attributes from set B, retains the corresponding basic communication feature element in set A, and keeps the intersection of set A and set B as an empty set.

3. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, The central control module (10) continuously receives network traffic logs reported by the traffic engine module (30), performs panoramic situational multidimensional analysis, and extracts asset activity status parameters from the network traffic logs. When the asset activity status parameters indicate that the internal business node has no network interaction records within a preset time period, the central control module (10) determines that the internal business node is in a disabled state and deletes the basic communication feature elements corresponding to the disabled internal business node from set A.

4. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, The overall control module (10) obtains the system load parameters and security protection level for the current time period; the overall control module (10) queries the built-in feature extraction mapping matrix to obtain the extraction quantity ratio. When the system load parameters are higher than the preset load threshold, the extraction quantity ratio is reduced, and when the security protection level is increased, the extraction quantity ratio is increased; the overall control module (10) multiplies the extraction quantity ratio by the total number of basic communication feature elements and the total number of high-risk decoy feature elements respectively and rounds down to determine the number of communication features extracted from set A and the number of decoy features extracted from set B.

5. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, The central control module (10) extracts the system clock parameters of the current time period and converts them into a fixed-length timestamp factor. The central control module (10) performs a serialization operation on the communication feature subset to generate a bit feature sequence, and performs a high-bit zero-padding alignment operation on the timestamp factor and the preset private salt value, so that the three have the same data length. The central control module (10) performs a bitwise XOR operation on the bit feature sequence, timestamp factor and private salt value after the high-bit zero-padding alignment operation to generate a combined verification sequence, and calls a one-way hash algorithm to perform an encrypted hash operation on the combined verification sequence to output a dynamic intrusion detection identifier.

6. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, The business proxy module (20) determines the embedding channel of the dynamic intrusion detection identifier based on the parsed network layer protocol identifier and application layer protocol identifier; When the network layer protocol identifier indicates Internet Protocol version 6 and the original data packet does not contain a hop-by-hop option extension header, the service agent module (20) inserts a hop-by-hop option extension header between the basic header and the upper layer protocol header, modifies the value of the next header field of the basic header, and divides the dynamic intrusion detection identifier into fixed-length data blocks and writes them into the type length value field of the hop-by-hop option extension header.

7. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, The traffic engine module (30) acts as an intrusion detection engine and disables the concurrent connection tracking mechanism of the underlying network protocol stack. The traffic engine module (30) concatenates the extracted target Internet Protocol address and target Transmission Control Protocol port number according to a preset bit order to generate a target access feature sequence. Based on the target access feature sequence, it extracts the corresponding bit feature sequence from the locally stored communication feature subset as a local feature sequence. It performs a bitwise XOR operation on the local feature sequence, timestamp factor, and private salt value after performing high-bit zero padding length alignment operation, and calls the local one-way hash algorithm to perform a hash operation on the output result of the bitwise XOR operation to generate a local intrusion feature comparison result.

8. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 7, characterized in that, When the hash comparison result indicates that the local intrusion feature hash comparison result is consistent with the dynamic intrusion detection identifier in the protocol header data, the traffic engine module (30) determines that the inbound data packet is a normal system access, determines that the inbound data packet comes from a legitimate business agent module (20) or an external agent client module (60), strips the protocol extension header in the inbound data packet and deletes the dynamic intrusion detection identifier carried; the traffic engine module (30) reads the global static address mapping table that records static mapping relationships synchronously issued by the central control module (10), and restores the target Internet Protocol address and target Transmission Control Protocol port number to the target Internet Protocol address and target Transmission Control Protocol port number of the internal business terminal according to the global static address mapping table.

9. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, When the target access feature does not match any element in the decoy feature subset, the traffic engine module (30) determines that the inbound data packet belongs to indiscriminate scanning intrusion traffic; the traffic engine module (30) releases the data frame buffer corresponding to the inbound data packet at the data link layer, and by truncating the network data flow at the data link layer, it avoids the network layer protocol stack processing flow of the operating system and prevents the operating system from generating error echo messages of the Internet Control Message Protocol.

10. The integrated protection platform for network boundary-oriented, full-domain service attacks according to claim 1, characterized in that, The platform also includes a hardware acceleration module (50), which is internally configured with a field-programmable gate array (FPGA) logic unit. After completing the cross-replacement operation of the destination address and source address of the response message, the security plug-in module (40) extracts the destination address field, the source address field, and the protocol identifier to generate a transport layer pseudo header and transmits it to the hardware acceleration module (50). The hardware acceleration module (50) reads the transport layer pseudo header through the FPGA logic unit, executes a hardware-level verification algorithm to calculate and write the network layer header checksum and the transport layer header checksum, generates a fake response data packet, and sends it to the external network boundary.

Images