CN107343011A - 一种基于动态目标防御的内源威胁防御设备 - Google Patents

一种基于动态目标防御的内源威胁防御设备 Download PDF

Info

Publication number
CN107343011A
CN107343011A CN201710784517.8A CN201710784517A CN107343011A CN 107343011 A CN107343011 A CN 107343011A CN 201710784517 A CN201710784517 A CN 201710784517A CN 107343011 A CN107343011 A CN 107343011A
Authority
CN
China
Prior art keywords
endogenous
equipment
dynamic
dynamic object
carried out
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201710784517.8A
Other languages
English (en)
Inventor
李春强
于磊
丘国伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Jingwei Xin'an Technology Co Ltd
Original Assignee
Beijing Jingwei Xin'an Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Jingwei Xin'an Technology Co Ltd filed Critical Beijing Jingwei Xin'an Technology Co Ltd
Priority to CN201710784517.8A priority Critical patent/CN107343011A/zh
Publication of CN107343011A publication Critical patent/CN107343011A/zh
Pending legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明描述了一种基于动态目标防御的内源威胁防御设备。本发明针对设备IP地址、设备MAC地址、设备端口、设备服务、蜜罐系统的动态变换实现，实现基于动态目标防御的内源威胁防御设备，进而增大内源攻击者识别内源威胁防御设备的难度。

Description

一种基于动态目标防御的内源威胁防御设备
技术领域
本发明涉及一种网络安全防御设备，尤其涉及一种基于动态目标防御的内源威胁防御设备。
背景技术
内源威胁区别于外源威胁，攻击者来自于企事业单位内部设备或用户，检测困难，危害性大。随着企业信息安全机制的建立建全，单纯想从外部渗透进入目标系统的攻击门槛不断提高。内源威胁逐渐增多，并且开始在各大安全报告中崭露头角，引起了国外研究者的高度重视。遗憾的是，国内此类事件曝光率极低，研究重视不够，因此缺乏行之有效的防范措施。
动态目标防御技术是通过多样的、不断变化的构建、评价和部署机制及策略来增加攻击者的攻击难度及代价，有效限制脆弱性暴露及被攻击的机会。现有基于IP的网络安全防御设备，多数存在容易被攻击者识别发现和被攻击者发起拒绝服务攻击的风险。
发明内容
本发明目的在于提供一种基于动态目标防御的内源威胁防御设备。本发明针对设备IP地址、设备MAC地址、设备端口、设备服务、蜜罐系统的动态变换实现，实现基于动态目标防御的内源威胁防御设备，进而增大内源攻击者识别内源威胁防御设备的难度。
本发明的技术方案如下：
一种基于动态目标防御的内源威胁防御设备，其包括：
A、动态目标防御调度模块，对设备IP地址、MAC地址、端口、服务、蜜罐系统等进行动态变换调度；
B、设备IP变换子模块，对设备IP地址进行动态变换；
C、设备MAC地址变换子模块，对MAC地址进行动态变换；
D、设备开放端口变换子模块，对设备开放端口进行动态变换；
E、设备开放服务变换子模块，对设备开放服务进行动态变换；
F、设备蜜罐系统变换子模块，对设备蜜罐系统进行动态变换。
所述方法，其中模块A的中动态变换是根据一定算法规律的变换，进而实现变换可控。
本发明所提供的一种基于动态目标防御的内源威胁防御设备，结构简单，易于实现，增大了内源攻击者识别内源威胁防御设备的难度。
附图说明
图1为本发明的结构简图。
具体实施方式
以下结合附图，将对本发明的较佳实施例进行较为详细的说明。
如图1所示，本发明结构简单，由动态目标防御调度模块、IP变换子模块、MAC变换子模块、端口变换子模块、服务变换子模块、蜜罐变换子模块组成。
动态目标防御调度模块负责统一调度IP变换子模块、MAC变换子模块、端口变换子模块、服务变换子模块、蜜罐变换子模块，下发变换指令及变换值等。
本发明实现的具体步骤如下:
步骤A 动态目标防御调度模块负责针对IP、MAC、端口、服务、蜜罐等生成特定动态变换算法，并将变换指令和变换值下发到各子模块；
步骤B IP变换子模块、MAC变换子模块、端口变换子模块、服务变换子模块、蜜罐变换子模块收到动态目标防御调度模块发送的变换指令和变换值后，开启变换并变换为指定变换值；
在步骤A中，运行动态变换算法运用密钥进行变换，防御者在知晓密钥的情况可以在任意时间计算出设备IP、MAC、端口、服务、蜜罐等状态及数值。
应当理解的是，上述针对具体实施方式的描述较为详细，不能因此而认为是对本发明专利保护范围的限制，本发明的专利保护范围应以所附权利要求为准。

Claims (2)

1.一种基于动态目标防御的内源威胁防御设备，其特征在于包括如下模块：
A、动态目标防御调度模块，对设备IP地址、MAC地址、端口、服务、蜜罐系统等进行动态变换调度；
B、设备IP变换子模块，对设备IP地址进行动态变换；
C、设备MAC地址变换子模块，对MAC地址进行动态变换；
D、设备端口变换子模块，对设备端口进行动态变换；
E、设备服务变换子模块，对设备开放服务进行动态变换；
F、设备蜜罐系统变换子模块，对设备蜜罐系统进行动态变换。
2.根据权利要求1所述的一种基于动态目标防御的内源威胁防御设备，其特征在于：其中模块A的动态变换是根据一定算法规律的变换，进而实现变换可控。
CN201710784517.8A 2017-09-04 2017-09-04 一种基于动态目标防御的内源威胁防御设备 Pending CN107343011A (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710784517.8A CN107343011A (zh) 2017-09-04 2017-09-04 一种基于动态目标防御的内源威胁防御设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710784517.8A CN107343011A (zh) 2017-09-04 2017-09-04 一种基于动态目标防御的内源威胁防御设备

Publications (1)

Publication Number Publication Date
CN107343011A true CN107343011A (zh) 2017-11-10

Family

ID=60214539

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710784517.8A Pending CN107343011A (zh) 2017-09-04 2017-09-04 一种基于动态目标防御的内源威胁防御设备

Country Status (1)

Country Link
CN (1) CN107343011A (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110798423A (zh) * 2018-08-01 2020-02-14 阿里巴巴集团控股有限公司 消息处理方法及装置、安全防护设备及终端设备
CN111404935A (zh) * 2020-03-16 2020-07-10 广州锦行网络科技有限公司 基于攻击行为分析的蜜罐服务端口自适应应用方法及系统
CN111835694A (zh) * 2019-04-23 2020-10-27 张长河 一种基于动态伪装的网络安全漏洞防御系统
CN114465747A (zh) * 2021-09-28 2022-05-10 北京卫达信息技术有限公司 基于动态端口伪装的主动欺骗防御方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103051615A (zh) * 2012-12-14 2013-04-17 陈晶 一种蜜场系统中抗大流量攻击的动态防御系统
CN104144164A (zh) * 2014-08-06 2014-11-12 武汉安问科技发展有限责任公司 基于网络入侵的扩展防御方法
CN104506511A (zh) * 2014-12-15 2015-04-08 蓝盾信息安全技术股份有限公司 一种sdn网络动态目标防御系统及方法
CN104853003A (zh) * 2015-04-30 2015-08-19 中国人民解放军国防科学技术大学 一种基于Netfilter的地址、端口跳变通信实现方法
CN105721442A (zh) * 2016-01-22 2016-06-29 耿童童 基于动态变换虚假响应系统、方法及网络安全系统与方法
US20170104780A1 (en) * 2015-10-08 2017-04-13 Siege Technologies LLC Assessing effectiveness of cybersecurity technologies

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103051615A (zh) * 2012-12-14 2013-04-17 陈晶 一种蜜场系统中抗大流量攻击的动态防御系统
CN104144164A (zh) * 2014-08-06 2014-11-12 武汉安问科技发展有限责任公司 基于网络入侵的扩展防御方法
CN104506511A (zh) * 2014-12-15 2015-04-08 蓝盾信息安全技术股份有限公司 一种sdn网络动态目标防御系统及方法
CN104853003A (zh) * 2015-04-30 2015-08-19 中国人民解放军国防科学技术大学 一种基于Netfilter的地址、端口跳变通信实现方法
US20170104780A1 (en) * 2015-10-08 2017-04-13 Siege Technologies LLC Assessing effectiveness of cybersecurity technologies
CN105721442A (zh) * 2016-01-22 2016-06-29 耿童童 基于动态变换虚假响应系统、方法及网络安全系统与方法

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110798423A (zh) * 2018-08-01 2020-02-14 阿里巴巴集团控股有限公司 消息处理方法及装置、安全防护设备及终端设备
CN110798423B (zh) * 2018-08-01 2022-04-15 阿里巴巴集团控股有限公司 消息处理方法及装置、安全防护设备及终端设备
CN111835694A (zh) * 2019-04-23 2020-10-27 张长河 一种基于动态伪装的网络安全漏洞防御系统
CN111835694B (zh) * 2019-04-23 2023-04-07 张长河 一种基于动态伪装的网络安全漏洞防御系统
CN111404935A (zh) * 2020-03-16 2020-07-10 广州锦行网络科技有限公司 基于攻击行为分析的蜜罐服务端口自适应应用方法及系统
CN114465747A (zh) * 2021-09-28 2022-05-10 北京卫达信息技术有限公司 基于动态端口伪装的主动欺骗防御方法及系统
CN114465747B (zh) * 2021-09-28 2022-10-11 北京卫达信息技术有限公司 基于动态端口伪装的主动欺骗防御方法及系统

Similar Documents

Publication Publication Date Title
CN107343011A (zh) 一种基于动态目标防御的内源威胁防御设备
Inkster China’s cyber power
Yuan et al. Resilient control of cyber-physical systems against denial-of-service attacks
Zhong et al. Cyber security in smart DC microgrid operations
CN105141641A (zh) 一种基于SDN的Chaos移动目标防御方法及系统
Manson Cyberwar: The United States and China prepare for the next generation of conflict
CN103916387B (zh) 一种防护ddos攻击的方法及系统
Wendzel et al. Envisioning smart building botnets
Van Dine et al. Outpacing cyber threats: Priorities for cybersecurity at nuclear facilities
CN107968776A (zh) 一种基于双向控制函数的动态攻击面变换方法
CN107508817B (zh) 一种企事业单位内源威胁网络安全防御设备
Fursov et al. Smart Grid and wind generators: an overview of cyber threats and vulnerabilities of power supply networks
kamal Kaur et al. Security analysis of smart grids: Successes and challenges
Gollmann Security for cyber-physical systems
Xu et al. Attack identification for software-defined networking based on attack trees and extension innovation methods
CN108322460B (zh) 一种业务系统流量监测系统
Robbins Cyberattack hits indian nuclear plant
Wu et al. Optimal switching integrity attacks in cyber-physical systems
Guo Design of adaptive marine network intrusion detection and dynamic defense system
Buzatu Advanced Persistent Threat Groups Increasingly Destabilize Peace and Security in Cyberspace
Okhanashvili Cyber security and malware
Denning Whither cyber terror? 10 years after September 11
Codella et al. Continuous assurance for cyber physical system security
Lindsay Inflated Cybersecurity Threat Escalates US-Chna Mistrust
Bellovin et al. As simple as possible---but not more so

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WD01 Invention patent application deemed withdrawn after publication
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20171110