CN1421772A

CN1421772A - New system safety guarding method of observing invading scan behavior

Info

Publication number: CN1421772A
Application number: CN 01129120
Authority: CN
Inventors: 王云
Original assignee: ANMENG SCIENCE AND TECHNOLOGY CO LTD SICHUAN
Current assignee: ANMENG SCIENCE AND TECHNOLOGY CO LTD SICHUAN
Priority date: 2001-11-27
Filing date: 2001-11-27
Publication date: 2003-06-04

Abstract

The present invention proposes one new method of observing invasion scan behavior and prevent port invasion. The method includes of establishing port monitoring, accepting, client side data request, closing monitoring scan connecting port and other execution programs. The method features the judgement of whether or not invasion scanning exists through closing monitoring scan port, altering port, etc; monitoring and recording scan information via the port; and blocking invasion scan behavior via continuous close of scan port and altering monitoring port. The method has the advantages of accurate judgment of invasion behavior, reliable scan information record, etc.

Description

A kind of new method of discovering inbreak scan behavior protection system safety

Technical field:

The present invention relates to a kind of guard method of network security, definitely say so to relate to and a kind ofly can discover a kind of technical method that the invador is scanned behavior protection system safety effectively.

Background technology:

There is not a kind of instrument can as Internet, change the world in the world today, duty is sought in shopping from network, online transaction, online investment on the net, from the broadcasting bulletin system to E-mail, from the news report to the preview, sports and amusement, no matter minor matter or global major issue, almost all knowledge since the dawn of human civilization can obtain on the net, people more and more dependency network change oneself life, enjoy the huge facility that it brings.But,, come the threat on the automatic network also to increasingly sharpen in the behind of this prosperity; total some people puts law and gives and ignoring in the society for playing one's own game; utilize network to spy on other people secret, even be engaged in illegal activity, so network security protection has become the important topic of current network security work.Inbreak scan is the first step before the invador implements to attack, and also is the gimmick that they habitually practise.Because the service of each website all is disclosed, system must respond all requests, therefore generally can't judge whether the port of people in scanning oneself, like this, detection to port scanning also just becomes a great problem, the invador utilizes this point just, by using scanner that network objectives is carried out port scanning, the distribution of various tcp ports of target remote server and the service that provides can be provided with leaving no trace, be which kind of operating system, there is any known leak, their software versions, some information of service, also just can be indirectly or recognize the existing safety problem of distance host intuitively, for next step attack is prepared.If we can have the inbreak scan stage of a kind of way before intruder attack, just can perceive the scanning behavior of port invasion effectively, and the system manager sent warning information, just can take the precautionary measures timely and effectively, simultaneously also can be by the port scanning record, judge assailant's the source position of coming,, the track of offender of public security department is had very big help system manager's recovery system after attack.

Summary of the invention:

The objective of the invention is to: solve the difficult problem that the port scanning that exists at present detects, for the user provide a kind of can discover effectively the invasion scan line for and the source and the new method of taking precautions against, be that network security protection increases new technical measures.

The new method of discovering inbreak scan behavior protection system safety of the present invention; monitor by set up port at this machine; receive client data request; closing the executive routines such as scanning connectivity port of monitoring forms; it is characterized in that: after having closed the scanning connectivity port of monitoring; rebuild a new listening port; after new port is scanned connection again; close this port again; change a new listening port again, like this, be scanned and connect a port; just close this port at once; build new port again, so circulate, and note the information that is scanned at listening port; and send warning information to the system manager, recover initial listening port then.

The invention has the advantages that: 1. monitor, can judge the port that is scanned and note scanning information, provide preparation, also follow the trail of the invador and offer help for relevant department for the system manager takes precautions against the invasion attack by setting up port; 2. the change listening port by continuously is connected with the continuous scanning that is subjected to, and can judge the inbreak scan behavior exactly; 3. by constantly closing port and the new listening port of change that is scanned connection, can stop the port scanning intrusion behavior effectively.

Description of drawings:

The present invention has given the executive routine process flow diagram of discovering inbreak scan behavior protection system safety new method.

Embodiment:

Discovering the core of inbreak scan behavior protection system safety method, is to monitor by setting up port, for the continuous invasion port scanning that occurs, takes constantly to change the measure of listening port, stops up contingent port intrusion behavior.

Its concrete implementing measure is finished by following executive routine:

1, utilizing the serverSocket technology to set up a plurality of ports at this machine monitors.

Partial code: int port=5; ServerSocket ss=new ServerSocket (port);

2, wait for client (Client) request of data (Accept).

Partial code: Socket s=ss.accept ();

3, receive client-requested.

Partial code: if (s!=null) ...;

4, close serverSocket (port monitoring).

Partial code: ss.close ();

5, utilizing the serverSocket technology to add 5 algorithm by original port sets up new port and monitors.

Partial code: port+=5; ServerSocket ss=new ServerSocket (port);

6, judge whether the port numbers of monitoring has at present satisfied the program requirement.

Partial code: if (port==50) ...;

7, writing scan information.

Partial code: insertLog (IP);

8, send a warning message.

Partial code: sendAlert (EMAIL);

9, recovering initial port monitors.

Partial code: port=5; ServerSocket ss=new ServerSocket (port);

Claims

1; a kind of new method of discovering inbreak scan behavior protection system safety; monitor by set up port at this machine; receive client data request; closing executive routines such as monitoring the scanning connectivity port forms; it is characterized in that: after having closed the scanning connectivity port of monitoring; rebuild a new listening port; after new port is scanned connection again; close this port again; reconstruct a new listening port again, like this, be scanned and connect a port; just close this port at once; build new port again, so circulate, and note the information that is scanned at listening port; and send warning information to the system manager, recover initial listening port then.