CN1805385A - Network security emulation system and its emulation method - Google Patents
Network security emulation system and its emulation method Download PDFInfo
- Publication number
- CN1805385A CN1805385A CN 200610041653 CN200610041653A CN1805385A CN 1805385 A CN1805385 A CN 1805385A CN 200610041653 CN200610041653 CN 200610041653 CN 200610041653 A CN200610041653 A CN 200610041653A CN 1805385 A CN1805385 A CN 1805385A
- Authority
- CN
- China
- Prior art keywords
- network
- function
- interface
- virtual network
- module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to a network safe simulation system and relative imitation method. The logical function of said network safe simulation system comprises: a virtual network module, a attack-defend dynamic chain connection base, a system control module, and a display module, while said logical functions are displayed by the control layer, virtual network device layer, public interface layer, middle layer and bottom function base. The virtual network device can simulate the host machine, router, firewall, network card, concentrator, and network wire on the single machine to connect each virtual network device to form the virtual network. The process that using said virtual network to process the safe simulation comprises: first, setting the user program; distributing system parameter document; coding the system; imitated operating the coded system in the operating system; at last collecting the simulated data according to which makes the network safety analyst. The invention has easy operation and extended availability, which can be used as network safety research simulation environment and imitation platform.
Description
Technical field
The present invention relates to network and information security, specifically a kind of network security emulation system and emulation mode thereof can be used for the technical research and the emulation of computer network and network safety filed.
Background technology
Along with network technology itself be applied to the continuous development of the technology of network, network attack and defence both this disappear that are long, promote mutually, and because the continuous increase of network size and network architecture increasingly sophisticated, network security problem is more outstanding.The research of network security problem and use the aspect mainly concentrate on defense technique for a period of time, in order to accomplish that Know the enemy and know yourself, and you can fight a hundred battles with no danger of defeat, the research cyber-attack techniques that also should go deep into is made the principle of diverse network attack technology clear.Generally speaking, should combine the two and place with studying under a kind of environment, but this respect is operated in current certain limitation that also exists, its main cause is to lack to carry out network security research and environment of applications and analogue system.
Though, existing network simulation technology is many, network simulation platform OPNet, NS2 and network simulation software OMNet, CNet etc. are typically arranged, but these emulation tools mainly are to carry out analogue simulation at the signal intelligence of network or procotol, and can not be to network security problem, especially can not simulate for the emulation of attack on the network and defence, and for attacking and the combine network security of carrying out of defence is used and carried out good analogue simulation.Therefore, just make the research of cyber-attack techniques carry out less.
The content of invention
The objective of the invention is to overcome the deficiency that network simulation software can not carry out the network security problem analog simulation targetedly, a kind of network security emulation system and emulation mode thereof are provided, to realize that network security is carried out analog simulation.
Technical scheme of the present invention relates to the content of three aspects, and the one, be the logic function system of network security emulation system, the 2nd, the system configuration of realization network security analog logic function, the 3rd, utilize network security emulation system to carry out the method for safe simulation.Wherein:
One. the logic function of network security emulation system comprises:
The virtual network module is used to carry out the simulation of network attacking and defending simulation and network security;
The attacking and defending dynamic link library is used for providing new attack and defense module with the form of plug-in unit to system, and network attacking and defending analogue system is expanded;
Present module, be used for the pilot process of system's operation and the operation result of system's stage are presented;
System control module is used for the running of system is arranged and dispatched, and coordinates described other several sections and carry out directly mutual.
Above-mentioned network security emulation system, wherein the virtual network module comprises: live network and virtual network, this real network is meant physical network, i.e. local area network (LAN), wide area network or internet; This virtual network is meant the network that carries out emulation on the separate unit main frame.
Above-mentioned network security emulation system, wherein the attacking and defending dynamic link library comprises network attack dynamic link library and cyber-defence dynamic link library, and this attack dynamic link library comprises that packet is intercepted, TCP, operating system are surveyed, leak is attacked, distributed denial of service Dos attacks; This defence dynamic link library comprises antivirus protection, fire compartment wall, intrusion detection.
Above-mentioned network security emulation system presents wherein that module shows and the form that presents The results of running mainly contains running log, process report, computing chart or dynamic image.
Two. the system configuration that realizes network security analog logic function comprises:
Key-course is used for realizing the system logic function is controlled;
The virtual network device layer is used for the situation of analog network on unit, promptly simulates main frame, router, fire compartment wall, network interface card, hub, these basic network equipments of netting twine on unit;
The common interface layer is used for the various function library standardization on the intermediate layer, and the system that makes upwards provides unified calling interface;
The intermediate layer, be used for the system function of bottom function library and basic storehouse are encapsulated the formation function storehouse, this function library comprises third parties such as the attacking and defending function library of moulding, general network attacking and defending function library, network security tool exploitation function library Libnet increase income function library, network selecting transducer and show class libraries;
The bottom function library is used for the own function of call operation system or procotol, and this storehouse comprises that operating system carries function library, analog network function library, basic display function library.
Above-mentioned network security emulation system structure, wherein key-course comprises: network control module, device control module and Subscriber Interface Module SIM, virtual network environment is set up and adjusted to this network control module, the state and the operation of the virtual network device in this device control module control virtual network environment, this Subscriber Interface Module SIM outwards provides unified calling interface.
Above-mentioned network security emulation system structure, wherein the common interface layer comprises: network interface and display interface, this network interface carries out the increase income interface of function library and network selecting transducer of third parties such as the attacking and defending function library of moulding in the described intermediate layer, general network attacking and defending function library, network security tool exploitation function library Libnet integrated and unitized, offers the virtual network device layer to call; This display interface is for the virtual network device layer provides literal demonstration, graphical demonstration, pictorialization shows and dynamic explicit function interface shows calling function.
Three. utilize network security emulation system to carry out the method for safe simulation, carry out according to the following procedure:
(1) sets user program, configuration-system Parameter File, and system is compiled;
(2) compiled system is put carry out simulation run in the operating system environment;
(3) data of emulation are collected;
(4) carry out the network security analysis according to the data of collecting.
Set user program, system for filling parameter configuration files in the said method and system compiled, carry out according to the following procedure:
(1) is the main frame of the attack in the system, the main frame of defence, the specific functional module of main frame appointment of safety detection, writes corresponding user program more according to demand, and carry out related with corresponding apparatus;
(2) fill in quantity kind, topology of networks and the pairing program file of each network equipment of selected network type, selected network equipment;
(3) written program file and configuration file are carried out related in system, and generate the operating file that directly to carry out.
In the said method compiled system put and carries out simulation run in the operating system environment, carry out as follows:
(1) analogue system is carried out initialization;
(2) parameter in the analogue system is set dynamically, promptly from the system parameters configuration file, read corresponding numerical value the parameter in the analogue system is carried out assignment, comprise the division of subnet, the Internet Protocol IP of each main frame (InternetProtocol) address setting, fire compartment wall IP address setting, each Port IP address of router, and detection rule, the router policy of fire compartment wall are set;
(3) according to the parameter that sets the logical correctness of network is verified,, the error message feedback is configured again and sets, till network can true(-)running if set incorrectly;
(4) adjust each network equipment to ready state, system's l-G simulation test that brings into operation is till all finishing emulation.
In the said method analogue system is carried out initialization, carries out according to the following procedure:
(1) reads in CONFIG.SYS, configuration file is resolved, the various parameters in the extraction system;
(2) according to the parameter that is extracted, the needed environment of judgement system is simulated environment or true environment; To required simulated environment, be virtual network with system initialization, and the setting network interface is a virtual network interface; To required live network, be single main frame with system initialization, and the setting network interface is the live network interface;
(3) show selected network environment and init state information;
(4) activate the network equipment, the connectedness between the adjacent network equipment is tested, the adjacent network equipment is interconnected.
The present invention has following characteristics compared with prior art:
Need design and realize because the logic function of secure network analogue system of the present invention is the analog simulation at network security, solved the problem of network security problem research simulated environment and emulation platform; Simultaneously because the system configuration of the invention process logic function with very similar, very easy to use in the operation of real network environment, can utilize system and method for the present invention to carry out the technical research and the Simulation Application of computer network and network safety filed; Can carry out the secondary code exploitation as required because the designed network security emulation system of the present invention comprises attacking and defending dynamic link library and display part in addition, improve the expandability of native system and method greatly.
Description of drawings
Fig. 1 is a network security emulation system building-block of logic of the present invention
Fig. 2 is a network security emulation system implementation structure schematic diagram of the present invention
Fig. 3 is a virtual network device structure chart of the present invention
Fig. 4 is that virtual network device state of the present invention shows schematic diagram
Fig. 5 is a network security emulation system workflow diagram of the present invention
Fig. 6 is the initialization flowchart of network security emulation system of the present invention
Embodiment
One. system configuration
With reference to Fig. 1, network security emulation system logical construction of the present invention is by virtual network module, attacking and defending dynamic link library, system control module, present these four parts of module and cooperate mutually and form the logical construction of a network security emulation system.Wherein:
The virtual network module is platform and the basic environment that carries out the network security simulation, and the simulation of network security is carried out in virtual network.Virtual network comprises real stand-alone environment and virtual network environment.Real stand-alone environment is meant the stand-alone environment that is arranged in the actual physics network, and the real network here can be local area network (LAN), wide area network or internet.Virtual network environment is meant the network environment of emulation on the separate unit main frame.
The attacking and defending dynamic link library comprises network attack dynamic link library and cyber-defence dynamic link library.Because network security roughly is divided into attack on the network and the defence on the network, attack on the network roughly is divided into passive attack and active attack two big classes, comprises that packet is intercepted, TCP, operating system are surveyed, leak is attacked, distributed denial of service Dos attacks etc.Therefore, the attack on the network can be carried out careful division, each single attack technology is all made the dynamic link library that other programs can be called.Defense technique on the network is also a lot, comprises antivirus protection, firewall technology, Intrusion Detection Technique etc.These defense techniques are compiled into the dynamic link library that other programs can be called, and dynamic link library offers system with the form of plug-in unit, have guaranteed the autgmentability and the flexibility of system.Also can provide new attack and defense module to come network attacking and defending analogue system is expanded in this way very easily.
Present module, be similar to user interface, finish that mainly the pilot process of system's operation and the operation result of system's stage are presented.The form that presents is more versatile and flexible, can be running log, process report, computing chart or dynamic image.Its requirement is, the displaying of visualization should be arranged, and again data carried out statistical analysis.
System control module is finished other parts is carried out total control, and it is directly mutual to coordinate other several sections, and the running of system is arranged and dispatched.Under the unified control and scheduling of system control module, the network equipments such as main frame in the virtual network module call attack and the defense module in the attacking and defending dynamic link library, these are attacked and defense module is the attack concrete in the live network and the playback of defence, they finish the function of attacking and defending automatically in virtual network environment, the result of attacking and defending is by presenting module and be apparent on the user interface or be recorded in the customer documentation the most at last, thereby finishes the analog simulation of network attacking and defending.
With reference to Fig. 2, network security emulation system implementation structure schematic diagram of the present invention comprises key-course, virtual network device layer, common interface layer, intermediate layer and five functional hierarchies of bottom function library.These five functional hierarchies are the specific implementations to Fig. 1 logical construction.Wherein, system control module is corresponding to key-course, the virtual network module is mainly corresponding to the relevant portion in virtual network device layer and the bottom function library, attacking and defending dynamic link library correspondence is in the intermediate layer, process demonstration/object module corresponds respectively to the relevant portion in virtual network device layer, common interface layer, intermediate layer and the bottom function library, and is as shown in table 1.
The corresponding relation of table 1 Fig. 1 and Fig. 2
| 4 modules among Fig. 1 | Relevant portion among pairing Fig. 2 |
| System control module | Key-course |
| The virtual network module | Virtual network device layer and bottom function library |
| The attacking and defending dynamic link library | The intermediate layer |
| Present module | Virtual network device layer, common interface layer, intermediate layer and bottom function library |
Composition of each layer and function are as follows respectively:
1. key-course
Key-course is finished the initialization of whole system, the initialization of each module, in the running of system each module is controlled, and some senior calling interfaces are provided.This key-course is made up of three concrete modules, is respectively network control module, device control module and Subscriber Interface Module SIM.Network control module is responsible for the foundation and the adjustment of virtual network environment, the state and the operation of the virtual network device in the device control module control virtual network environment, Subscriber Interface Module SIM outwards provide unified calling interface to make the exploitation based on system are more prone to.
The virtual network device layer: the situation when being mainly used on unit analog network, the common equipment in the network is simulated.The transmission of all data is finished by internal system in the analog network, be not related with live network, but is the same from the angle of using with live network, the data of a plurality of network layers are provided for the user according to demand, for example, can provide Ether frame, IP bag, TCP bag, UDP bag etc.Like this, just need simulate basic virtual network devices such as main frame, router, fire compartment wall, network interface card, hub, netting twine on unit, the specific implementation of these virtual network devices as shown in Figure 3.
These virtual network devices all comprise three functional modules except that netting twine and hub, be respectively data forwarding module, data processing module and network attacking and defending module.Wherein, data forwarding module is realized by network interface card; Data processing module is different because of different equipment, but its function is identical with the real network equipment, and for example main frame needs comprehensive data processing function, router needs the function of routing forwarding, the function that fire compartment wall needs data filter etc.; Just realize the equipment of corresponding attack or defence type for different attack module of different equipment interpolations or defense module, mainly be meant main frame and fire compartment wall, these attack modules and defense module is exactly directly calling or comprehensively calling the attacking and defending class libraries of moulding and general attacking and defending analog function storehouse.
Network interface card in the described virtual network device, its function are reception and the forwardings of finishing data, and to the data that arrive according to certain feature, information such as IP address for example, simply discerning, selectively transmit data then, is that these virtual network devices need jointly.The essential information of network interface card has IP address, medium access control MAC Address, data buffer zone, data forwarding functional module.
Hub in the described virtual network device and netting twine equipment are realized based on network interface card, promptly are the network interface cards of oversimplifying.The function of hub is the mode of data by broadcasting that will arrive, and sends to all main frames that are connected with this hub, if do not belong to the scope of this hub, just it is transmitted to another hub.This hub is the network interface card of having oversimplified, and its attribute has the host information record that is connected with this hub and with the recording of information of another hub of this hub cascade etc.This netting twine also is the network interface card of having oversimplified, and netting twine is all directly transmitted for any data that arrive, and promptly by the indiscriminate other end that sends to of this end of netting twine, what equipment what do not consider that the other end of netting twine connects is.Hub has data buffer zone and data forwarding functional module, and netting twine has only the data forwarding functional module.
Main frame in the described virtual network device comprises a network interface card, and this network interface card is attached to main frame and is responsible for exchanges data in self main frame calcaneus rete network.Network interface card in the main frame has four kinds of essential informations of network interface card: IP address, MAC Address, data buffer zone, data forwarding functional module, and the MAC Address of Network Card of the network interface card IP of main frame and main frame is exactly the IP and the MAC Address of its network interface card of comprising for the main frame that only comprises a network interface card.The function of main frame in network may be varied, considers the function of native system, and the function that is had on the main frame simply is divided into: transmission, the reception of packet, the generation to packet attacked, this four big function of defensive attack.In order to realize these functions, give the certain attribute of host definition, make it can in virtual environment, realize these functions.These attributes mainly comprise the basic operating system information of Hostname, main frame, the network interface card IP of main frame, the MAC Address of Network Card of main frame and its connection topology information.Main frame also needs to load as required dynamic functional module, and these functional modules mainly are the function libraries that can call for main process equipment of dynamic attacking and defending chained library and other etc.
Router in the described virtual network device is a data routing forwarding equipment, and router has several ports just to comprise several network interface cards, and the network interface card in the router is responsible in router and extraneous exchanges data.In addition, router also designs the data buffer zone and is used for buffer memory and carries out the data of routing forwarding, and design has routing table, and design has algorithm and the strategy that carries out routing forwarding.Each network interface card in the router has four kinds of essential informations of network interface card: IP address, MAC Address, data buffer zone, data forwarding functional module.
Fire compartment wall in the described virtual network device adopts the dual-homed host structure, comprises two network interface cards, and network interface card and outer network interface card in these two network interface cards may be defined as respectively are responsible for the exchange of intranet data and outer net data.Simultaneously, fire compartment wall has also designed the detection engine and has detected rule, and the detection engine of fire compartment wall and detection rule can design realization according to concrete needs, for example can be packet filtering and rule-based detection.Each network interface card in the fire compartment wall has four kinds of essential informations of network interface card: IP address, MAC Address, data buffer zone, data forwarding functional module.
Each virtual network device connected just form virtual network, because other network equipments except that netting twine all comprise one or polylith network interface card, with netting twine the network interface card between the distinct device being coupled together also becomes network with regard to accordingly these equipment being linked together.It is identical that the characteristics of this connection network are followed in real network environment with mode.When realizing, concrete program can utilize the method for pointer or the method for function call that the data transmission interface of the port of netting twine and network interface card is connected, and so just can be from the interoperability of data between the network bottom layer assurance equipment.The state of each virtual network device shows as Fig. 4.Every kind equipment wherein all will show certain state information and procedural information according to its needs.These information display settings in the virtual network device object, are configured the relevant information of these equipment with the form of graphical, interfaceization and show dynamically at key-course, increase the visualization and the visualize of safe analogue system.Shown information comprises static information and multidate information two parts, and the static information indicating equipment itself has some attributes, for example the IP address of the title of equipment, equipment, the ready flag of equipment; Multidate information is dynamically to present in the process of system operation of equipment, and for example equipment is subjected to reaction, equipment after network analog is attacked to the defence presentation information of attacking etc.
2. common interface layer
The common interface layer is the standardization of the function library of Fig. 2 each layer below the common interface layer to be offered system carry out unified calling interface.This common interface comprises network interface and display interface two parts, this network interface carries out the interface of increase income third party's function library and network selecting transducers such as the attacking and defending function library of the moulding in Fig. 2 intermediate layer, general network attacking and defending function library, network security tool exploitation function library Libnet integrated and unitized, offers last layer and calls.Display interface has the literal demonstration for last layer provides the demonstration calling function of some necessity, these Presentation Functions, graphically shows, pictorialization shows and dynamic explicit function interface.
3. intermediate layer
The intermediate layer is that the system function of bottom and basic storehouse are encapsulated formed function library, the function library that this function library comprises has: the attacking and defending function library of moulding, general network attacking and defending function library, network security tool are developed the third party's function libraries of increasing income such as function library Libnet, and these function libraries comprise that function library Libnet is constructed and sent to packet, network packet is caught function library Libpcap, universal network safe function storehouse Libdnet, network invasion monitoring function library Libnids, SSL function library OpenSSL etc., network selecting transducer and shown class libraries.These function libraries are announced details, can come with carrying out secondary development.Wherein, the attacking and defending class libraries of moulding is to be compiled into the dynamic link library that can directly be called execution with having the integration of common attack and defensive measure and method now, and these are attacked and defensive measure designs as required.For example, once complete Port Scan Attacks, once complete operating system is surveyed and is attacked, and the defence of surveying at TCP and operating system.General network attacking and defending function library than the attacking and defending function library of moulding more near operating system, it is the public function of the attacking and defending class library call of moulding, because the network attack of moulding or defence have a lot of similar or identical operations at the preparatory stage or the initial period of defence or attack, for example for the analysis of IP address, for simple parsing of network packet or the like, finish this type of work so design general network attacking and defending function library.The function library that Libnet, Libpcap, Libdnet, OpenSSL etc. increase income than the function of general network attacking and defending function library more specifically and details, network attacking and defending analogue system is provided these function libraries of increasing income and more the operating system and the network interface of low layer partly carry out mutual numerous functions.The network selecting transducer is provided at the function of changing between real network and the virtual network, real network is meant the physical network of reality, can be that local area network (LAN) also can be a wide area network, virtual network is meant the network of using the virtual network device analogue simulation fully, and the design of network selecting transducer makes the environment for use of system be expanded in the real network.Show that class libraries provides Presentation Function commonly used, have basic text display, graphical display and chart to show.
4. bottom function library
The bottom function library mainly contains operating system and carries function library, analog network function library, basic display function library and system call.These function libraries or system call are relevant with procotol itself with used operating system.
Two. safe analogy method
The step of using said system to carry out safe simulation comprises system's preparation, system's operation, data collection and interpretation of result.Wherein the work of three aspects is prepared to comprise by system, is respectively to write corresponding user program according to demand, fill in relevant configuration file and system's compiling; System's operation is meant carries out simulation run with compiled system in certain operating system system environments, determine and the running status of the various operational factors of system are subjected to the restriction that back is set; After data collection and interpretation of result are meant system's end of run, carry out the collection of emulated data, and the analysis of carrying out the network security aspect according to the data of collecting.
1. the preparation before system uses
(1) writes corresponding user program according to demand; Be that each main frame in the system specifies specific functional module, for example that main frame is the main frame of attacking, and that main frame is the main frame that is on the defensive, and that main frame is the main frame etc. that carries out safety detection; Also to carry out modular combination accordingly for other network equipments in the system or module, to finish its function corresponding; Carry out related with corresponding apparatus institute's written program file.
(2) fill in the relevant configuration file, this configuration file is used for quantity kind, topology of networks and the pairing program file of each network equipment etc. of the selected network type of recording user, selected network equipment.This network type be meant the user needed be virtual network or live network, virtual network can be selected a plurality of network equipments, and connects the composition network.The corresponding file of each network equipment, file is used for storing the program that the user need carry out.The general user does not need the pairing file of changed network equipment, adopts default value, and advanced level user can the self-defined network equipment, satisfies higher level needs.Network topology structure is the foundation that connects into network of network virtual equipment, and control desk makes up and the initialization network according to topological structure.
(3) system's compiling, this compiling is the same with common program compilation process, compile based on corresponding operating system, the purpose of compiling is to being that first step written program file and configuration file are carried out related in system and generate the operating file that can directly carry out.
2. the actual motion of system
With reference to Fig. 5, the running of network security emulation system of the present invention is as follows:
(1) analogue system is carried out initialization.
This initialization procedure comprises the initialization at control desk master interface and the initialization in display layer storehouse, and control desk master interface is exactly the visual of key-course among Fig. 2, and Adjustment System is to ready state, the operation of products for further.Concrete initialization procedure is:
At first, configuration file is read in system, configuration file is resolved the various parameters in the extraction system; Secondly, root
Judge that according to the parameter that is extracted needed environment is simulated environment or true environment, this judgement is to carry out according to the related content in the configuration file.If needed environment is a simulated environment, be virtual network then, and network interface is set is virtual network interface with system initialization.If needed environment is a live network, be single main frame then, and network interface is set is the live network interface with system initialization.The true environment here is meant actual network environment, local area network (LAN) or internet; Simulated environment is meant the network environment of simulating on unit;
Then, carry out initialization and show, with the demonstration of the correlation behavior information report property in the initialization procedure; At last,
Activate the network equipment, test the connectedness between each network equipment, the adjacent network equipment is interconnected.
(2) carry out network configuration
After initialization is finished, the every network parameter in the system is carried out correct setting, promptly from the system parameters configuration file, read corresponding value the parameter in the analogue system is carried out assignment, the network parameter that needs to set mainly contains, the division rule of subnet, the IP address setting of each main frame, fire compartment wall IP address setting, each Port IP of router are set.Simultaneously, also to set accordingly for the detection rule of fire compartment wall and the routing policy of router as required.
(3) verification of correctness: mainly be that the logical correctness of network is verified.For example, whether IP address format is correct, and whether identical IP is arranged, and whether network connects correct etc.If set incorrect, then with error message feedback, so that network is reconfigured and sets, till network can true(-)running according to feedback information.
(4) the adjustment network equipment is ready
Analogue system is adjusted each network equipment to ready state according to various configuration informations in the network and set information, and waiting system further moves.
(5) system's operation
After ready, system can bring into operation, and this moment, system was according to set program running, until the attacking and defending analog simulation test of user's design is all finished.During this period, the state that the user can the Real Time Observation network also can suspend the network operation and check ruuning situation, recovers the operation of network afterwards again, also can directly end the network operation.
(6) discharge dynamic resource
When system's end of run, the dynamic resource of the operating system at place is discharged.
3. data collection
Behind system's end of run, carry out the collection of emulated data, the channel of data collection has the running log data of each network equipment in the system, the relevant statistics in the system etc.Can take the mode of manual process to carry out for the processing of the data of collecting, just the user of system carries out the processing of certain mode to data.In addition, also can utilize the data processing software tool for processing to analyze related data.
4. network security analysis
Carry out the analysis of network security aspect according to the data of collecting, by the analysis of result being inquired into the rule of network security, the checking network security policy provides the thinking and the method that solve network security problem.
Emulation experiment of the present invention is as follows:
Utilize system of the present invention that the security configuration of certain LAN environment is carried out emulation, purpose is that the rule setting of fire compartment wall and the function of Technology of Network Sniffer are studied.The preparation of experiment is the collection network packet, these network packet of collecting are exactly to need the test data used in the local area network (LAN), its method of obtaining is that the network interface card to certain station server in the local area network (LAN) carries out long-term intercepting and obtains, obtaining real network data, and these network datas are resolved to the form that analogue system directly can be called; Testing used network topology is the simplification of LAN topology; The setting of firewall rule also is that the function of real fire compartment wall in the local area network (LAN) and necessity of rule are simplified in the experiment.
The equipment of building network topology comprises in the experiment: three main process equipments, a hub device, a router device and a firewall box.Wherein first Hostname is Host1, and its IP address is 192.168.33.1; Second Hostname is Host2, and its IP address is 192.168.33.2; The 3rd Hostname is Host3, and its IP address is 192.168.35.3; The name of router is called Router, and it has two network interface cards, and the IP of these two network interface cards is respectively 192.168.33.15 and 192.168.33.16; The name of fire compartment wall is called Firewall, and it also has two network interface cards, and the IP of these two network interface cards is respectively 192.168.35.16 and 192.168.35.15.Annexation between these network equipments is that main frame Host1 directly links to each other with hub with Host2; The IP of hub and router is that the network interface card of 192.168.33.15 links to each other; The IP of router is that the IP of the network interface card of 192.168.33.16 and fire compartment wall is that the network interface card of 192.168.35.16 links to each other; The IP of fire compartment wall is that the network interface card of 192.168.35.15 links to each other with main frame Host3.In virtual network graph topology, added four functional modules in this example, the one, on main frame Host1, add the functional module that sends packet, this module sends packet to the tcp port 2008-2015 of Host3 main frame; The 2nd, on main frame Host2, add the sniffer functional module, all packets of this network segment are caught; The 3rd, on main frame Host3, add the functional module of accepting packet; The 4th, on fire compartment wall Firewall, add firewall rule, to filter all tcp data bag of port numbers 2008 to 2010 that mails to main frame Host3 from main frame Host1.
The result shows:
Main frame Host1 can carry out packet according to predetermined requirement and send; Sniffer on the main frame Host2 also can move normally, can capture all packets of this network segment;
Main frame Host3 has received only the tcp data bag of port from 2011 to 2015, meets the setting of firewall rule, shows that simultaneously the wall of setting fire has filtered out the tcp data bag of port from 2008 to 2010;
Complete errorless arrival of energy of router network packet and forwarding show that router is working properly.
In addition, by the functional module of further each network equipment of analysis and the statistics output information of system, with more network security problems such as checking network security collocation strategies, for example setting of the filtering policy of fire compartment wall, the sniffer effect in network etc.
As seen, system of the present invention and emulation mode are feasible fully, and can finish the analog simulation of network security, result according to emulation, just can study, and the setting of real network environmentAL safety strategy is provided guiding conclusion or method with correct configuration the network security problem of reality.
Claims (10)
1. network security emulation system, its logic function comprises:
The virtual network module is used to carry out the simulation of network attacking and defending simulation and network security;
The attacking and defending dynamic link library is used for providing new attack and defense module with the form of plug-in unit to system, and network attacking and defending analogue system is expanded;
Present module, be used for the pilot process of system's operation and the operation result of system's stage are presented;
System control module is used for the running of system is arranged and dispatched, and coordinates described other several sections and carry out directly mutual.
2. network security emulation system according to claim 1 is characterized in that the virtual network module comprises live network and virtual network, and this real network is meant physical network, i.e. local area network (LAN), wide area network or internet; This virtual network is meant the network that carries out emulation on the separate unit main frame.
3. network security emulation system according to claim 1, it is characterized in that the attacking and defending dynamic link library comprises network attack dynamic link library and cyber-defence dynamic link library, this attack dynamic link library comprises that packet is intercepted, TCP, operating system are surveyed, leak is attacked, dos attack; This defence dynamic link library comprises antivirus protection, fire compartment wall, intrusion detection.
4. structure that realizes claim 1 logic function comprises:
Key-course is used for realizing the system logic function is controlled;
The virtual network device layer is used for the situation of analog network on unit, promptly simulates main frame, router, fire compartment wall, network interface card, hub, these basic network equipments of netting twine on unit;
The common interface layer is used for the various function library standardization on the intermediate layer, and the system that makes upwards provides unified calling interface;
The intermediate layer, be used for the system function of bottom function library and basic storehouse are encapsulated the formation function storehouse, this function library comprises the attacking and defending function library of moulding, general network attacking and defending function library, Libnet increase income third party's function library, network selecting transducer and show class libraries;
The bottom function library is used for the own function of call operation system or procotol, and this storehouse comprises that operating system carries function library, analog network function library, basic display function library.
5. structure according to claim 4, it is characterized in that key-course comprises: network control module, device control module and Subscriber Interface Module SIM, virtual network environment is set up and adjusted to this network control module, the state and the operation of the virtual network device in this device control module control virtual network environment, this Subscriber Interface Module SIM outwards provides unified calling interface.
6. structure according to claim 4, it is characterized in that the common interface layer comprises: network interface and display interface, this network interface carries out the increase income interface of third party's function library and network selecting transducer of the attacking and defending function library of moulding in the described intermediate layer, general network attacking and defending function library, Libnet integrated and unitized, offers the virtual network device layer and calls; This display interface is for the virtual network device layer provides literal demonstration, graphical demonstration, pictorialization shows and dynamic explicit function interface shows calling function.
7. method of utilizing claim 4 to carry out safe simulation, carry out according to the following procedure:
(1) sets user program, configuration-system Parameter File, and system is compiled;
(2) compiled system is put carry out simulation run in the operating system environment;
(3) data of emulation are collected;
(4) carry out the network security analysis according to the data of collecting.
8. according to utilizing the described method of claim 7, wherein set user program, system for filling parameter configuration files and system is compiled, carry out according to the following procedure:
(1) is the main frame of the attack in the system, the main frame of defence, the specific functional module of main frame appointment of safety detection, writes corresponding user program more according to demand, and carry out related with corresponding apparatus;
(2) fill in quantity kind, topology of networks and the pairing program file of each network equipment of selected network type, selected network equipment;
(3) written program file and configuration file are carried out related in system, and generate the operating file that directly to carry out.
9. according to utilizing the described method of claim 7, wherein compiled system is put and carries out simulation run in the operating system environment, carry out as follows:
(1) analogue system is carried out initialization;
(2) parameter in the analogue system is set dynamically, promptly from the system parameters configuration file, read corresponding numerical value the parameter in the analogue system is carried out assignment, comprise the division of subnet, the IP address setting of each main frame, fire compartment wall IP address setting, each Port IP address of router, and detection rule, the router policy of fire compartment wall are set;
(3) according to the parameter that sets the logical correctness of network is verified,, the error message feedback is configured again and sets, till network can true(-)running if set incorrectly;
(4) adjust each network equipment to ready state, system's l-G simulation test that brings into operation is till all finishing emulation.
10. according to utilizing the described method of claim 9, wherein said analogue system is carried out initialization, carry out according to the following procedure:
(1) reads in CONFIG.SYS, configuration file is resolved, the various parameters in the extraction system;
(2) according to the parameter that is extracted, the needed environment of judgement system is simulated environment or true environment; To required simulated environment, be virtual network with system initialization, and the setting network interface is a virtual network interface; To required live network, be single main frame with system initialization, and the setting network interface is the live network interface;
(3) show selected network environment and init state information;
(4) activate the network equipment, the connectedness between the adjacent network equipment is tested, the adjacent network equipment is interconnected.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB200610041653XA CN100403706C (en) | 2006-01-11 | 2006-01-11 | Network security emulation system and its emulation method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB200610041653XA CN100403706C (en) | 2006-01-11 | 2006-01-11 | Network security emulation system and its emulation method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1805385A true CN1805385A (en) | 2006-07-19 |
| CN100403706C CN100403706C (en) | 2008-07-16 |
Family
ID=36867238
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB200610041653XA Expired - Fee Related CN100403706C (en) | 2006-01-11 | 2006-01-11 | Network security emulation system and its emulation method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100403706C (en) |
Cited By (19)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102054142A (en) * | 2011-01-28 | 2011-05-11 | 李清宝 | Platform for simulating and training on hardware safety defects |
| CN101247266B (en) * | 2008-03-21 | 2011-05-25 | 深圳市国人射频通信有限公司 | Method for processing data in Ethernet |
| CN102752119A (en) * | 2012-07-09 | 2012-10-24 | 南京中兴特种软件有限责任公司 | Interface realizing method for intelligent network card |
| CN101727348B (en) * | 2008-10-10 | 2013-02-13 | 华为数字技术（成都）有限公司 | Method and device for analyzing suspicious codes |
| CN103001823A (en) * | 2012-11-13 | 2013-03-27 | 中国科学院信息工程研究所 | Method and system for establishing virtual network on basis of multi-grit abstract theory |
| CN103067200A (en) * | 2012-12-18 | 2013-04-24 | 王钰 | Method and system of network counteraction effect simulation |
| WO2013086968A1 (en) * | 2011-12-16 | 2013-06-20 | 北京神州绿盟信息安全科技股份有限公司 | Method, device and system for network security protection |
| CN103401843A (en) * | 2013-07-11 | 2013-11-20 | 广州中长康达信息技术有限公司 | Method and system for simulating and detecting cloud security |
| CN104778073A (en) * | 2015-04-17 | 2015-07-15 | 广东电网有限责任公司信息中心 | Novel information security attack and defense experiment platform and implementation method thereof |
| CN105024990A (en) * | 2015-03-30 | 2015-11-04 | 清华大学 | Deployment method and device for network security attack and defense exercise environment |
| CN105827468A (en) * | 2016-06-08 | 2016-08-03 | 成都万纬信息技术有限公司 | Real-time monitoring method for network performance |
| CN109361534A (en) * | 2018-09-20 | 2019-02-19 | 中国航天系统科学与工程研究院 | A kind of network security emulation system |
| CN111599242A (en) * | 2020-05-28 | 2020-08-28 | 广西民族师范学院 | Computer network teaching virtual simulation system |
| CN111786832A (en) * | 2020-07-01 | 2020-10-16 | 哈尔滨工业大学（威海） | Method and device for interconnecting attack and defense platform and various industrial control scenes |
| CN112104633A (en) * | 2020-09-07 | 2020-12-18 | 西安电子科技大学 | Attack chain construction method based on log correlation analysis |
| CN112822212A (en) * | 2021-02-06 | 2021-05-18 | 西安热工研究院有限公司 | Network security vulnerability detection method for non-contact type hydropower monitoring system |
| CN113014589A (en) * | 2021-03-05 | 2021-06-22 | 公安部第三研究所 | 5G communication safety test method and system |
| CN113067728A (en) * | 2021-03-17 | 2021-07-02 | 中国人民解放军海军工程大学 | Network security attack and defense test platform |
| CN113810371A (en) * | 2021-08-04 | 2021-12-17 | 苏州椰云科技有限公司 | Safety management method for software and hardware decoupling platform |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101808084B (en) * | 2010-02-12 | 2012-09-26 | 哈尔滨工业大学 | Method for imitating, simulating and controlling large-scale network security events |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6278963B1 (en) * | 1997-07-01 | 2001-08-21 | Opnet Technologies, Inc. | System architecture for distribution of discrete-event simulations |
| KR100448262B1 (en) * | 2002-03-19 | 2004-09-10 | 지승도 | Network Security Simulation system |
| US7281015B2 (en) * | 2004-06-16 | 2007-10-09 | Northrop Grumman Corporation | Method and apparatus for providing an interface between system architect and OPNET |
| CN1300984C (en) * | 2004-12-02 | 2007-02-14 | 上海交通大学 | Method for establishing complex network running environmental analog stimulative platform |
-
2006
- 2006-01-11 CN CNB200610041653XA patent/CN100403706C/en not_active Expired - Fee Related
Cited By (28)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101247266B (en) * | 2008-03-21 | 2011-05-25 | 深圳市国人射频通信有限公司 | Method for processing data in Ethernet |
| CN101727348B (en) * | 2008-10-10 | 2013-02-13 | 华为数字技术（成都）有限公司 | Method and device for analyzing suspicious codes |
| CN102054142A (en) * | 2011-01-28 | 2011-05-11 | 李清宝 | Platform for simulating and training on hardware safety defects |
| CN102054142B (en) * | 2011-01-28 | 2013-02-20 | 李清宝 | Platform for simulating and training on hardware safety defects |
| WO2013086968A1 (en) * | 2011-12-16 | 2013-06-20 | 北京神州绿盟信息安全科技股份有限公司 | Method, device and system for network security protection |
| US9485261B2 (en) | 2011-12-16 | 2016-11-01 | NSFOCUS Information Technology Co., Ltd. | Web security protection method, device and system |
| CN102752119B (en) * | 2012-07-09 | 2015-06-24 | 南京中新赛克科技有限责任公司 | Interface realizing method for intelligent network card |
| CN102752119A (en) * | 2012-07-09 | 2012-10-24 | 南京中兴特种软件有限责任公司 | Interface realizing method for intelligent network card |
| CN103001823A (en) * | 2012-11-13 | 2013-03-27 | 中国科学院信息工程研究所 | Method and system for establishing virtual network on basis of multi-grit abstract theory |
| CN103001823B (en) * | 2012-11-13 | 2016-02-10 | 中国科学院信息工程研究所 | A kind of virtual network construction method based on many granularities abstract theory and system |
| CN103067200A (en) * | 2012-12-18 | 2013-04-24 | 王钰 | Method and system of network counteraction effect simulation |
| CN103067200B (en) * | 2012-12-18 | 2016-03-09 | 王钰 | A kind of intermingle density effect simulation method and system |
| CN103401843A (en) * | 2013-07-11 | 2013-11-20 | 广州中长康达信息技术有限公司 | Method and system for simulating and detecting cloud security |
| CN105024990A (en) * | 2015-03-30 | 2015-11-04 | 清华大学 | Deployment method and device for network security attack and defense exercise environment |
| CN104778073A (en) * | 2015-04-17 | 2015-07-15 | 广东电网有限责任公司信息中心 | Novel information security attack and defense experiment platform and implementation method thereof |
| CN105827468A (en) * | 2016-06-08 | 2016-08-03 | 成都万纬信息技术有限公司 | Real-time monitoring method for network performance |
| CN105827468B (en) * | 2016-06-08 | 2019-10-25 | 成都万纬信息技术有限公司 | Network performance method for real-time monitoring |
| CN109361534A (en) * | 2018-09-20 | 2019-02-19 | 中国航天系统科学与工程研究院 | A kind of network security emulation system |
| CN109361534B (en) * | 2018-09-20 | 2021-10-01 | 中国航天系统科学与工程研究院 | Network security simulation system |
| CN111599242A (en) * | 2020-05-28 | 2020-08-28 | 广西民族师范学院 | Computer network teaching virtual simulation system |
| CN111786832A (en) * | 2020-07-01 | 2020-10-16 | 哈尔滨工业大学（威海） | Method and device for interconnecting attack and defense platform and various industrial control scenes |
| CN111786832B (en) * | 2020-07-01 | 2022-06-07 | 哈尔滨工业大学（威海） | Method and device for interconnecting attack and defense platform and various industrial control scenes |
| CN112104633A (en) * | 2020-09-07 | 2020-12-18 | 西安电子科技大学 | Attack chain construction method based on log correlation analysis |
| CN112822212A (en) * | 2021-02-06 | 2021-05-18 | 西安热工研究院有限公司 | Network security vulnerability detection method for non-contact type hydropower monitoring system |
| CN112822212B (en) * | 2021-02-06 | 2022-12-02 | 西安热工研究院有限公司 | Network security vulnerability detection method for non-contact hydropower monitoring system |
| CN113014589A (en) * | 2021-03-05 | 2021-06-22 | 公安部第三研究所 | 5G communication safety test method and system |
| CN113067728A (en) * | 2021-03-17 | 2021-07-02 | 中国人民解放军海军工程大学 | Network security attack and defense test platform |
| CN113810371A (en) * | 2021-08-04 | 2021-12-17 | 苏州椰云科技有限公司 | Safety management method for software and hardware decoupling platform |
Also Published As
| Publication number | Publication date |
|---|---|
| CN100403706C (en) | 2008-07-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN1805385A (en) | Network security emulation system and its emulation method | |
| CN110098951A (en) | A kind of network-combination yarn virtual emulation based on virtualization technology and safety evaluation method and system | |
| CN110430190B (en) | Deception defense system based on ATT & CK, construction method and full link defense realization method | |
| CN107659543B (en) | Protection method for APT (android packet) attack of cloud platform | |
| US9954884B2 (en) | Method and device for simulating network resiliance against attacks | |
| US20120253779A1 (en) | Network stimulation engine | |
| US8554536B2 (en) | Information operations support system, method, and computer program product | |
| CN107070929A (en) | A kind of industry control network honey pot system | |
| CN112383538A (en) | Hybrid high-interaction industrial honeypot system and method | |
| US20030182582A1 (en) | Network security simulation system | |
| KR101534194B1 (en) | cybersecurity practical training system and method that reflects the intruder behavior patterns | |
| CN101567887A (en) | Vulnerability simulation overload honeypot method | |
| CN104461697B (en) | A kind of online IP address automatic capture system of virtual machine batch and method | |
| CN110224897A (en) | Vulnerable network test method, device, mobile device and the storage medium of application program | |
| CN116055566B (en) | Communication method, device and equipment of network target range and storage medium | |
| Niedermaier et al. | Network scanning and mapping for IIoT edge node device security | |
| Lupia et al. | ICS Honeypot Interactions: A Latitudinal Study | |
| Potteiger et al. | Evaluating the effects of cyber-attacks on cyber physical systems using a hardware-in-the-loop simulation testbed | |
| Anastasiadis et al. | A novel high-interaction honeypot network for internet of vehicles | |
| CN1992653A (en) | Testing system and method for automation test of Ethernet switch access control system | |
| JP2012083909A (en) | Application characteristic analysis device and program | |
| KR101854981B1 (en) | Method for generating data set for cyber warface exercise and technology verification and apparatus thereof | |
| Acosta et al. | A platform for evaluator-centric cybersecurity training and data acquisition | |
| CN114679334B (en) | Industrial control safety detection system based on multi-mode artificial intelligence | |
| CN114884744A (en) | Attack behavior analysis method and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| ASS | Succession or assignment of patent right |
Owner name: KUNSHAN RUIXIANG XUNTONG COMMUNICATION TECHNOLOGY Free format text: FORMER OWNER: XIDIAN UNIVERSITY Effective date: 20140910 |
|
| C41 | Transfer of patent application or patent right or utility model | ||
| COR | Change of bibliographic data |
Free format text: CORRECT: ADDRESS; FROM: 710071 XI'AN, SHAANXI PROVINCE TO: 215347 SUZHOU, JIANGSU PROVINCE |
|
| TR01 | Transfer of patent right |
Effective date of registration: 20140910 Address after: High tech Zone Kunshan city Jiangsu province 215347 Dengyun Road No. 268 Patentee after: Kunshan Ruixiang Xuntong Communication Technology Co., Ltd. Address before: Xi'an City, Shaanxi province Taibai Road 710071 No. 2 Patentee before: Xidian University |
|
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20080716 Termination date: 20180111 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |