An fttr cooperative intrusion detection and protection method based on behavior chain and kernel verification
By constructing a cross-gateway behavior chain and kernel verification for the FTTR network, the problem of insufficient single-point detection capability in the FTTR network is solved. It realizes the identification of multi-stage attacks across devices and the collaborative protection of the entire network, adapts to distributed hardware environments, and provides hierarchical protection and attack information tracing.
Patent Information
- Application Number
- CN202611403468.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-10
- Publication Date
- 2026-11-06
AI Technical Summary
Existing technologies in FTTR networks suffer from limited single-point detection capabilities, inability to identify multi-stage attacks across devices, a single detection mechanism, and a lack of collaborative protection capabilities.
By constructing a cross-gateway behavior chain and combining it with kernel verification, the identification and unified protection of cross-device behavior sequences are achieved. The main gateway uniformly generates protection policies and distributes them to sub-gateways for execution, forming a closed loop of collaborative protection across the entire network.
It enables the identification of cross-gateway attacks, reduces false positives and false negatives, adapts to the FTTR distributed hardware architecture, and provides tiered protection and attack information tracing capabilities.
Smart Images
Figure CN123055439A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology, and specifically relates to an FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification. Background Technology
[0002] With the widespread adoption of FTTR networking in home networks, the network architecture has evolved from a single gateway to a distributed network architecture consisting of a main gateway and multiple sub-gateways. This architecture connects the sub-gateways via fiber optic cables, achieving whole-house coverage and high-bandwidth communication, but it also presents new challenges to network security.
[0003] In an FTTR network, terminal devices access the network through different sub-gateways, and network communication, access behavior, and system operation status are distributed across multiple nodes. Attackers can exploit this distributed structure to launch multi-stage attacks through different sub-gateways. For example, they can first perform port scanning or weak password attempts on one sub-gateway, then initiate lateral access through another sub-gateway, and finally complete login or control operations on the main gateway, thus forming a cross-device, multi-stage attack path.
[0004] Existing intrusion detection technologies mainly suffer from the following problems:
[0005] (1) Limited single-point detection capability:
[0006] Traditional intrusion detection methods are typically deployed on a single device and analyze only local logs or network traffic. They cannot obtain cross-device behavioral information and are difficult to identify continuous attack behaviors distributed across multiple gateway nodes.
[0007] (2) Lack of utilization of behavioral chains:
[0008] While some existing technologies can analyze logs or traffic, they are usually based on single events or local behaviors within a short period of time, lacking overall modeling of behavioral sequences across time and devices, and thus unable to identify complex attack paths.
[0009] (3) Relying on a single detection mechanism makes it easy to be bypassed:
[0010] Detection methods that rely solely on matching behavioral rules are easily bypassed by attackers who construct pseudo-normal or scattered behaviors; while detection methods that rely solely on system integrity or kernel verification are difficult to detect attack paths at the logical level.
[0011] (4) Lack of collaborative defense capabilities:
[0012] In an FTTR environment, even if a gateway detects abnormal behavior, if it fails to synchronize with other sub-gateways and uniformly implement protection policies in a timely manner, the attack may still continue to spread through other paths, leading to lateral penetration of the entire network.
[0013] For example, in a real-world scenario, an attacker might attempt to log in to a sub-gateway multiple times within a short period using terminal A, successfully log in, and then initiate abnormal communication behavior on another sub-gateway while simultaneously loading a malicious module on the main gateway. If only single-point detection is used, it's difficult to simultaneously identify behavioral anomalies and system anomalies, let alone form a unified protection response.
[0014] Therefore, it is necessary to provide an intrusion detection method that combines behavioral chain analysis and kernel-mode consistency verification, and to achieve unified judgment and collaborative protection under the FTTR master-slave gateway architecture, thereby improving the ability to identify complex attacks and the overall defense capability. Summary of the Invention
[0015] The technical problem to be solved by this invention is to provide a collaborative intrusion detection and protection method based on behavior chain and kernel verification (FTTR), which solves the problems of limited single-point detection capability, inability to identify multi-stage attacks across devices, single detection mechanism and lack of collaborative protection capability in the existing technology.
[0016] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:
[0017] A collaborative intrusion detection and protection method for FTTR based on behavior chain and kernel verification, applied to an FTTR network containing one master gateway and at least one sub-gateway, includes the following steps:
[0018] S1. Obtain cross-gateway behavior chain data;
[0019] S2. Perform sequence matching between the cross-gateway behavior chain data and a preset intrusion detection model to identify abnormal behavior patterns;
[0020] S3. Perform kernel-mode consistency verification on the main gateway and sub-gateways;
[0021] S4. Combine the sequence matching results of the behavior chain and the kernel state consistency verification results to make a joint judgment and obtain the intrusion judgment result;
[0022] S5. The main gateway generates a protection strategy based on the intrusion detection result;
[0023] S6. The main gateway distributes the protection policy to the corresponding sub-gateways;
[0024] S7. The sub-gateway executes the protection policy and feeds back the execution result to the main gateway.
[0025] This solution utilizes a complete process—cross-gateway behavior chain acquisition, sequence matching, kernel-level verification, joint judgment, policy distribution, sub-gateway execution, and feedback—to move beyond the limitations of single-gateway local data. The cross-gateway behavior chain can connect attack events scattered across different sub-gateways; kernel-level verification identifies covert tampering behavior from the system's underlying layer; joint judgment integrates both behavioral and kernel-level evidence, preventing bypassing of single detection mechanisms; and the main gateway uniformly generates policies, which are then executed and transmitted back by sub-gateways, creating a closed loop of detection-judgment-execution-feedback to achieve network-wide collaborative FTTR protection, overcoming the limitations of single-point detection.
[0026] Furthermore, in step S1, obtaining cross-gateway behavior chain data includes:
[0027] Sub-gateways collect local behavioral events and report them to the main gateway; the main gateway receives behavioral events reported by each sub-gateway, merges the locally collected events, sorts all events in a unified time sequence, and completes cross-gateway event association based on device identifier, IP or MAC address to construct cross-gateway behavioral chain data.
[0028] In this solution, sub-gateways collect and report local events, while the main gateway completes the fusion of multi-source events. It establishes the correlation between events between different gateways based on device identifiers, IP addresses, and MAC addresses, and unifies the time sequence sorting. This solves the problem of isolated events and inconsistent time bases among sub-gateways, and stitches together fragmented attack events scattered across multiple gateways into a complete behavioral chain, providing a complete data source for identifying multi-stage attacks across devices.
[0029] Furthermore, in step S2, the sequence matching includes:
[0030] Sequence matching in step S2 includes:
[0031] Sorting events within cross-gateway behavior chains by time;
[0032] Extract consecutive event subsequences from a behavioral chain;
[0033] The event subsequences are compared and matched with the preset intrusion detection model.
[0034] In this approach, events within the behavioral chain are reordered chronologically, and continuous event subsequences are extracted for model comparison, without being limited to single isolated events. Since multi-stage attacks consist of a series of actions occurring sequentially, by extracting and matching continuous subsequences, it is possible to identify attack behaviors implemented step by step over a period of time, thus identifying multi-stage attack chains.
[0035] Furthermore, the preset intrusion detection model includes a brute-force attack model, a privilege escalation model, a lateral attack model, and a covert attack model;
[0036] The brute-force model is used to identify the behavior of multiple failed login attempts followed by a successful login within a preset time window.
[0037] The privilege escalation model is used to identify privilege change behavior when a process is switched from a regular user to a privileged user.
[0038] The lateral attack model is used to identify lateral penetration behaviors where abnormal access from a sub-gateway is accompanied by login associated with the main gateway.
[0039] The stealth attack model is used to identify intrusion behaviors that indicate inconsistent system states.
[0040] This solution establishes four models for high-frequency attack scenarios on FTTR networks, corresponding to brute-force attacks, privilege escalation, lateral movement, and covert system tampering. Models are customized based on the behavioral characteristics of different attacks to classify and identify attack types. This not only determines whether an intrusion has occurred but also distinguishes attack categories, providing a basis for generating targeted protection strategies.
[0041] Furthermore, in step S3, the kernel-mode consistency verification includes:
[0042] Compare the currently loaded kernel modules with the kernel record module information;
[0043] Verify network connectivity and port listening status;
[0044] Compare process status with system task information.
[0045] This solution performs consistency comparisons across three key kernel dimensions: kernel modules, network connection ports, and process tasks. Attackers can implant malicious modules, hide malicious processes, or open secret listening ports, all of which can cause inconsistencies between the aforementioned kernel information and baseline records. By performing verification at the system's lowest level, hidden backdoors and malicious modules that cannot be detected by behavior logs can be captured, compensating for the limitation of pure behavioral analysis, which can only identify upper-layer business behaviors.
[0046] Furthermore, in step S4, the joint determination method includes: when the behavior chain sequence matching hits the preset intrusion model, or when the behavior chain matching result and the kernel state verification anomaly simultaneously meet the preset conditions, it is determined that there is an intrusion behavior, and the intrusion type, occurrence time, associated behavior chain, and target device information are output.
[0047] In this solution, a multi-condition judgment logic of "behavioral hit model" or "behavioral + kernel dual anomaly" is set up. On the one hand, some attack behaviors are obvious and can be identified by behavioral chains alone. On the other hand, for highly covert attacks, both behavioral anomalies and kernel anomalies are required to determine intrusion. The dual condition constraint reduces false alarms. At the same time, the complete intrusion event elements are output to provide complete input for subsequent strategy generation.
[0048] Furthermore, the sub-gateway reports behavioral events to the main gateway using TCP long connections, UDP packets, or inter-process communication. The behavioral events are encapsulated in structured data, which includes device identifier, event type, timestamp, and behavioral characteristics.
[0049] This solution provides multiple communication transmission methods adapted to the FTTR gateway hardware environment. Events are encapsulated using structured fields, allowing the main gateway to directly parse the device source, occurrence time, and behavioral characteristics. This ensures reliable transmission of events across gateways, facilitates parsing, correlation, and sorting by the main gateway, avoids the difficulties of parsing unstructured logs, and reduces the probability of errors in behavior chain construction.
[0050] Furthermore, in step S6, the main gateway distributes the protection policy to the corresponding sub-gateways by either actively pushing it from the main gateway or by polling it from the sub-gateways.
[0051] This solution supports both proactive push and sub-gateway polling modes. Proactive push is suitable for scenarios where attacks need to be blocked immediately after an alarm occurs; polling mode is suitable for scenarios with unstable network links, where sub-gateways periodically obtain policies, improving the reliability of policy distribution in complex network environments and ensuring that protection policies reach sub-gateways.
[0052] Furthermore, in step S7, the sub-gateway executes protection policies including at least one of the following: packet filtering to block terminal communication, bandwidth limitation, termination of abnormal processes, and disconnection of terminal access.
[0053] This solution provides multiple tiered protection operations to take corresponding actions against intrusion behaviors of different risk levels. Low-risk behaviors can have their bandwidth limited, while high-risk behaviors can directly block communication, disconnect terminals, or kill malicious processes, thus achieving tiered handling and avoiding excessive damage to normal services caused by indiscriminate network outages.
[0054] The beneficial effects of this invention are:
[0055] (1) Implement cross-gateway attack behavior identification:
[0056] This invention constructs a global cross-gateway behavior chain for FTTR, which splices together fragmented attack events scattered across the main gateway and multiple sub-gateways according to time and device association. This breaks through the limitation of traditional single-point detection, which can only see local events of a single device, and effectively identifies multi-stage lateral penetration attacks across sub-gateways.
[0057] (2) The dual detection mechanisms complement each other, reducing false alarms and false negatives:
[0058] This invention combines upper-layer behavior chain sequence analysis with lower-layer kernel state consistency verification; behavior chain analysis identifies attack business logic and attack sequences, while kernel verification captures covert tampering behaviors such as malicious modules, hidden processes, and secret ports; the two are used together to determine attacks that are difficult to detect by a single mechanism, which can be supplemented by the other mechanism, reducing the possibility of attackers circumventing them.
[0059] (3) Achieve full-network collaborative closed-loop protection for FTTR:
[0060] In this invention, the main gateway uniformly completes event fusion and intrusion detection, generates unified protection policies, and distributes them to each sub-gateway for execution. The sub-gateways then report the execution results back. This eliminates the limitation to isolated alarms from a single gateway; once an attack is identified, all nodes in the network simultaneously execute protective actions, blocking lateral spread paths.
[0061] (4) Adapt to FTTR distributed hardware architecture:
[0062] In this invention, event reporting and policy distribution support multiple communication mechanisms, and support two distribution modes: proactive push and polling. Protection and handling provide multiple hierarchical operations, adapting to FTTR devices with different hardware performance and link quality, and are highly practical for engineering implementation.
[0063] (5) Attack information is complete and traceable:
[0064] In this invention, when an intrusion is determined, the intrusion type, time, associated behavior chain, and target device information are output, which facilitates the administrator to trace the attack path and provides a basis for generating differentiated protection strategies. Attached Figure Description
[0065] Figure 1 This is a schematic diagram of the intrusion detection process of the intrusion detection module in an embodiment of the present invention.
[0066] Figure 2 This is a flowchart illustrating the FTTR master-slave gateway linkage mechanism in an embodiment of the present invention. Detailed Implementation
[0067] This invention aims to provide a collaborative intrusion detection and protection method based on behavioral chains and kernel verification using FTTR (Fixed-Time Trial). This method addresses the limitations of existing technologies, such as limited single-point detection capabilities, inability to identify multi-stage cross-device attacks, simplistic detection mechanisms, and a lack of collaborative protection capabilities. The core idea is as follows: the main gateway aggregates events reported by all sub-gateways, constructs a global cross-device behavioral chain to identify multi-stage attacks, and simultaneously performs kernel-level integrity verification on the gateways. Intrusion is determined jointly by behavioral and kernel evidence. The main gateway then uniformly generates a protection policy, distributes it to each sub-gateway for execution, and the sub-gateways return the execution results.
[0068] More specifically, this includes the following aspects:
[0069] 1. Data aggregation and behavior chain construction: Each sub-gateway collects local terminal access, communication, and process behavior events and reports them to the main gateway. The main gateway integrates its own local events, relies on device identifiers and IP / MAC to complete event association, and constructs a cross-gateway behavior chain by chronological ordering. This connects attack actions scattered on different physical gateways into a complete attack chain, solving the problem of fragmentation of distributed network attack events.
[0070] 2. Dual-dimensional intrusion determination: On the one hand, the behavior chain matching unit compares the behavior sub-sequences with preset multi-type attack models to identify brute-force, privilege escalation, and lateral penetration attacks from the business behavior sequence level; on the other hand, the kernel verification unit compares the kernel module, process, and port connection status to identify hidden intrusions where the system's underlying layer has been tampered with; the intrusion determination unit integrates the two types of results to jointly output the intrusion determination, taking into account both upper-layer business behavior and lower-layer system status, and making up for the shortcomings of a single detection mechanism.
[0071] 3. Master-slave gateway collaborative closed-loop protection: After an intrusion is detected, the master gateway generates a corresponding protection policy and distributes it to the sub-gateways; the sub-gateways execute protection operations such as blocking, disconnecting terminals, and killing processes locally, and report the execution results back; so that an alarm in one place can trigger a coordinated response across the entire network, cutting off the attacker's lateral penetration channel across sub-gateways.
[0072] Example:
[0073] This embodiment provides a collaborative intrusion detection and protection method for FTTR based on behavior chain and kernel verification. It runs on an FTTR fiber-to-the-room networking system that includes a main gateway and several sub-gateways. The overall execution process of this method is divided into five major processes: event collection and reporting, cross-gateway behavior chain construction, intrusion detection judgment, protection policy generation and distribution, sub-gateway execution of protection and feedback of results.
[0074] During implementation, the main gateway deploys an intrusion detection module and a master-slave linkage control module. The intrusion detection module primarily handles detection tasks such as behavior chain matching, kernel-level consistency verification, and intrusion result determination. The intrusion detection process is described in [link to intrusion detection process]. Figure 1 More specifically, the intrusion detection module includes the following implementation units:
[0075] (1) Behavior chain matching unit, used to perform matching analysis on the event sequence in the behavior chain according to the preset intrusion model;
[0076] (2) Rule judgment unit, used to determine whether the behavior chain meets the preset intrusion conditions;
[0077] (3) Kernel verification unit, used to perform consistency checks on the system's operating status in order to identify covert attack behaviors;
[0078] (4) Intrusion determination unit, used to generate the final intrusion determination result by combining the behavior chain matching result and the kernel verification result.
[0079] The behavior chain matching unit traverses the events in the behavior chain in chronological order and performs sequence matching based on a preset behavior model, wherein the behavior model is defined as an event sequence composed of multiple behavior events in chronological order.
[0080] The matching process includes: sorting events in the behavior chain by time; extracting consecutive event subsequences in sequence; matching the event subsequences with a preset behavior model; and determining that a corresponding intrusion behavior exists when a match is successful.
[0081] The kernel verification unit is used to perform consistency checks on the system's operating state, including:
[0082] Perform a consistency comparison between the currently loaded module information and the kernel record information;
[0083] Perform consistency verification between network connection status and port listening status;
[0084] Perform a consistency comparison between process status information and system task information;
[0085] When an abnormal inconsistency is detected in the above information, it is determined that the system may be subject to covert intrusion.
[0086] The intrusion detection models include the following types:
[0087] (1) Brute-force attack model: When consecutive login failure events are detected within a preset time window, and then a login success event is detected, it is determined to be a brute-force attack.
[0088] (2) Privilege escalation model: When a permission change command is detected and the process permission changes from a normal user to a privileged user, it is determined to be an escalation behavior;
[0089] (3) Lateral attack model: When abnormal network access behavior is detected on the sub-gateway side and associated login behavior is detected on the main gateway side, it is determined to be a lateral penetration behavior;
[0090] (4) Covert attack model: When a discrepancy is detected between the system state and the actual operating state, it is determined to be a covert intrusion behavior.
[0091] The intrusion determination unit adopts a multi-condition combination determination method. When the behavior chain matching result meets the preset intrusion model, or when the behavior chain matching result and the kernel consistency detection result simultaneously meet the preset conditions, it is determined that there is an intrusion behavior, thereby improving the detection accuracy and reducing the false alarm rate.
[0092] When an intrusion is detected, the intrusion detection module generates intrusion event information, which includes the intrusion type, occurrence time, associated behavior chain, and target device information, and outputs it to the master-slave linkage control module for subsequent processing.
[0093] The master-slave linkage control module is responsible for data interaction between the master gateway and each sub-gateway, including receiving events reported by sub-gateways, issuing protection policies to sub-gateways, and receiving execution feedback from sub-gateways. For the FTTR master-slave gateway linkage mechanism, please refer to [link / reference needed]. Figure 2 The details are as follows:
[0094] The sub-gateway collects terminal access behavior, LAN communication behavior, and local process behavior locally. When it detects abnormal behavior that meets the preset trigger conditions, it reports the corresponding behavior event to the main gateway through a preset communication mechanism.
[0095] The main gateway receives behavioral event data from each sub-gateway and combines it with login behavior, WAN access behavior, and system operation status data collected locally by the main gateway. It then performs unified time sorting and data fusion on all behavioral events to construct a global behavioral event sequence.
[0096] The main gateway performs cross-gateway behavior correlation analysis based on the global behavior event sequence, constructs a cross-device behavior chain, and matches the behavior chain according to preset intrusion detection rules to determine whether intrusion behavior exists.
[0097] When an intrusion is detected, the main gateway generates an intrusion event and generates a corresponding control policy based on the intrusion type, which is then sent to each sub-gateway via the master-slave communication channel.
[0098] After receiving the control policy, the sub-gateway executes the corresponding protection operations locally, including but not limited to blocking communication of specified terminals based on packet filtering rules, limiting network bandwidth, terminating abnormal processes, or disconnecting terminal access, thereby achieving distributed collaborative protection.
[0099] The communication mechanism between the sub-gateway and the main gateway can be implemented using a socket-based TCP long connection, UDP packet, or inter-process communication mechanism. The behavioral event data is encapsulated in a structured data format, including device identifier, event type, timestamp, and behavioral feature fields.
[0100] When performing behavior event fusion, the main gateway establishes cross-gateway data associations based on the mapping relationship between device identifiers, IP addresses, or MAC addresses, and sorts and filters behavior events based on a preset time window to ensure the temporal consistency of behavior chain construction.
[0101] The control policy is issued by either the main gateway actively pushing the policy or the sub-gateway polling the policy. When executing the control policy, the sub-gateway blocks or restricts abnormal behavior by calling the local network filtering module or the system interface.
[0102] Although embodiments of the present invention have been described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the present invention, and all such changes and alterations shall not depart from the protection scope of the present invention.
Claims
1. A collaborative intrusion detection and protection method for FTTR based on behavior chain and kernel verification, applied to an FTTR network containing one main gateway and at least one sub-gateway, characterized in that, Includes the following steps: S1. Obtain cross-gateway behavior chain data; S2. Perform sequence matching between the cross-gateway behavior chain data and a preset intrusion detection model to identify abnormal behavior patterns; S3. Perform kernel-mode consistency verification on the main gateway and sub-gateways; S4. Combine the sequence matching results of the behavior chain and the kernel state consistency verification results to make a joint judgment and obtain the intrusion judgment result; S5. The main gateway generates a protection strategy based on the intrusion detection result; S6. The main gateway distributes the protection policy to the corresponding sub-gateways; S7. The sub-gateway executes the protection policy and feeds back the execution result to the main gateway.
2. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 1, characterized in that, In step S1, obtaining cross-gateway behavior chain data includes: Sub-gateways collect local behavioral events and report them to the main gateway; the main gateway receives behavioral events reported by each sub-gateway, merges the locally collected events, sorts all events in a unified time sequence, and completes cross-gateway event association based on device identifier, IP or MAC address to construct cross-gateway behavioral chain data.
3. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 1, characterized in that, In step S2, the sequence matching includes: Sequence matching in step S2 includes: Sorting events within cross-gateway behavior chains by time; Extract consecutive event subsequences from a behavioral chain; The event subsequences are compared and matched with the preset intrusion detection model.
4. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 3, characterized in that, The preset intrusion detection models include brute-force attack model, privilege escalation model, lateral attack model, and covert attack model; The brute-force model is used to identify the behavior of multiple failed login attempts followed by a successful login within a preset time window. The privilege escalation model is used to identify privilege change behavior when a process is switched from a regular user to a privileged user. The lateral attack model is used to identify lateral penetration behaviors where abnormal access from a sub-gateway is accompanied by login associated with the main gateway. The stealth attack model is used to identify intrusion behaviors that indicate inconsistent system states.
5. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 1, characterized in that, In step S3, the kernel-mode consistency verification includes: Compare the currently loaded kernel modules with the kernel record module information; Verify network connectivity and port listening status; Compare process status with system task information.
6. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 1, characterized in that, In step S4, the joint determination method includes: when the behavior chain sequence matching hits the preset intrusion model, or when the behavior chain matching result and the kernel state verification anomaly simultaneously meet the preset conditions, it is determined that there is an intrusion behavior, and the intrusion type, occurrence time, associated behavior chain, and target device information are output.
7. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 1, characterized in that, Sub-gateways report behavioral events to the main gateway using TCP long connections, UDP packets, or inter-process communication. The behavioral events are encapsulated in structured data, which includes device identifier, event type, timestamp, and behavioral characteristics.
8. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 1, characterized in that, In step S6, the main gateway distributes the protection policy to the corresponding sub-gateways by either actively pushing it from the main gateway or by polling it from the sub-gateways.
9. The FTTR collaborative intrusion detection and protection method based on behavior chain and kernel verification as described in claim 1, characterized in that, In step S7, the sub-gateway executes protection policies including at least one of the following: packet filtering to block terminal communication, bandwidth limitation, termination of abnormal processes, and disconnection of terminal access.