TWI797676B - Pre-processing method and system for nuclear network risk dection and computer readable medium thererof - Google Patents

Abstract

The present invention is a pre-processing method and a system for nuclear network risk detection. An Internet Protocol address slicing module arranges the IP addresses to be scanned, and then sends them to a sub-scanning module for scanning. Therefore, the scanning network segment can be dispersed effectively, and packet loss caused by congestion or delay in a single host and local network can be avoided. Further, protection about a large number of brute force scanning attacks monitored by the scanning target hardware or software can be bypassed, it can avoid that known vulnerabilities that cannot be detected. The memory resource shortage caused by a large number of scans of a single host at the same time also be reduced in the present invention. The present invention also provides a computer-readable medium for executing the method of the present invention.

Description

Nuclear network risk detection pre-processing method, system and computer-readable medium thereof

The present invention relates to a nuclear network detection technology, in particular to a nuclear network risk detection pre-processing method, system and computer readable medium.

With the rapid development of technology, the network assets of the enterprise intranet continue to increase, and the requirements for internal information security continue to increase. Therefore, it is necessary to understand intranet problems through inspections. Among them, scanning within the Internet range can help system administrators New vulnerabilities are discovered, and the deployment of monitoring equipment can also transparently display the distributed ecosystem.

There are some parts to be improved in the existing scanning mechanism, such as the lack of a decentralized scanning network segment mechanism, which may easily cause a single host and the local area network to block or cause packet loss due to delay, thereby affecting the correctness and integrity of vulnerability detection; secondly, the existing When the random scanner is executed, it needs to use a list to record the random IP address to be scanned, so it needs to spend system resources to record the random number sequence, which will consume memory resources, and there is a possibility of repeated scanning or missing the host to be scanned; in addition, the existing The step-by-step scanner scans sequentially one Internet Protocol address (IP) by IP Under software protection detection, it may be considered as a large number of brute force table scanning attacks, and scanning failures may occur.

Therefore, how to overcome the various deficiencies of the aforementioned prior art, especially, how to reduce network congestion, packet loss, and excessive consumption of system resources during nuclear network detection, or avoid being mistaken for violent table scanning Attacks, this will become a problem that technical personnel are eager to solve.

In view of the above problems, the present invention proposes a pre-processing method for nuclear network risk detection, which includes: receiving the IP address range to be scanned; converting the IP address range to generate the corresponding IP address range The initial start point value and the initial end point value of the address range; the initial start point value and the initial end point value are converted into a new start point value and a new end point value by a normalization function; a first prime number greater than the new end point value is obtained , a random number between the new start value and the new end point value and a second prime number smaller than the first prime number are operated to generate a remainder; and the remainder is converted into the IP addresses within the IP address range.

In the above method, the operation of the first prime number, the random number and the second prime number includes multiplying the random number by the second prime number, and then dividing by the first prime number to obtain the remainder.

In the above method, after generating the remainder, further comprising: multiplying the remainder by the second prime number, and then dividing by the first prime number to obtain the next remainder; and repeatedly performing the above operations until the last generated Until the next remainder is equal to the remainder, wherein, the remainder, the next remainder, and all remainders up to the last generated next remainder are sequentially transformed by the denormalization function into the sequence of IP addresses.

In the aforementioned method, further comprising scanning the several IP addresses in the array for risk detection in sequence.

The present invention further proposes a nuclear network risk detection system, which includes: an IP address slicing module and a sub-scanning module. The IP address slicing module includes: a value conversion unit, which is used to perform value conversion on the received IP address range to be scanned, so as to generate an initial start point value and an initial end point value corresponding to the IP address range ;The normalization unit is used to convert the initial starting point value and the initial ending point value into a new starting point value and a new ending point value through a normalization function; the remainder unit is used to convert the initial starting point value and the initial ending point value into a new starting point value and a new ending point value; The first prime number, a random number between the new starting point value and the new end point value, and a second prime number smaller than the first prime number are operated to generate a remainder; and the denormalization unit is used to The remainder is converted into an IP address within the IP address range through a denormalization function; in addition, the sub-scanning module is used for scanning the IP address for risk detection.

In the above-mentioned system, the remainder unit further includes using the remainder as the next random number, and generating the next remainder in the same operation until the last generated next remainder is equal to the remainder, and making the remainder, the next A remainder and all remainders up to the next remainder generated at last are sequentially transformed by the denormalization function into the sequence of IP addresses.

In the above-mentioned system, the sub-scanning module scans several IP addresses in the array for risk detection sequentially.

In the foregoing method and system, the normalization function subtracts a value from the initial starting value to make the new starting value 1.

In the foregoing method and system, the denormalization function adds the remainder to the value to generate a denormalized sequence.

In addition, after the denormalized sequence is converted into binary, it is converted into the IP address.

The present invention further proposes a computer-readable medium, which is applied to a computing device or a computer and stores instructions to execute the aforementioned pre-processing method for nuclear network risk detection.

In summary, through the nuclear network risk detection pre-processing method, system and computer-readable medium of the present invention, it can provide automatic nuclear network risk detection pre-processing, wherein the IP address slicing module uses Mathematical operations randomly arrange the IP addresses to be scanned, and then send them to the sub-scanning module for scanning, which is used to quickly scan the vulnerabilities of the entire network segment within the enterprise in a horizontal manner. In particular, the present invention converts the network segments to be scanned and combines the characteristics of prime numbers The random scanning address obtained by calculation can not only scan the host repeatedly and without omission, but also effectively disperse the scanning network segments to avoid packet loss caused by congestion or delay between a single host and the local network; secondly, for A system with many hosts and protection software can also effectively bypass the hardware or software protection of the scanning target to monitor a large number of brute-force table scanning attacks to prevent known vulnerabilities from being detected; moreover, for multiple single hosts with multiple network cards and multiple In an Internet Protocol (IP) environment, the present invention can effectively reduce the shortage of memory resources caused by a large number of scans of a single host at the same time, thereby reducing the scanning time and the response time error of the checked service, which will cause serious vulnerability detection. error.

2: Nuclear network risk detection system

21:Internet protocol address slicing module

211:Numerical conversion unit

212:Standardization unit

213: take the remainder unit

214: Denormalization unit

22: Sub-scan module

S101~S105: steps

S310~S401: Process

FIG. 1 is a step diagram of the pre-processing method for nuclear network risk detection of the present invention.

Fig. 2 is a system architecture diagram of the nuclear network risk detection system of the present invention.

Fig. 3 is a flow chart of a specific embodiment of the pre-processing method for nuclear network risk detection of the present invention.

FIG. 4 is a schematic diagram of the cycle used to generate the remainder of random permutation of IP addresses according to the present invention.

The following describes the technical content of the present invention through specific embodiments, and those skilled in the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied in other different specific implementation forms.

FIG. 1 is a step diagram of a pre-processing method for nuclear network risk detection in the present invention. In nuclear network risk detection, if each IP address is simply checked in numerical order, it may cause serious congestion, delay, and even loss of many packets in the regional network. In this regard, the present invention proposes nuclear network risk Before detection, the sub-scanning module scans for risk detection by generating randomly arranged IP addresses.

As shown in the figure, in step S101, an IP address range to be scanned is received. This step is to obtain the relevant information of the IP address to be scanned, so as to determine the range of the Internet Protocol (IP address) of the relevant equipment in the nuclear network to be scanned.

In step S102, numerical conversion is performed on the IP address range to generate an initial start point value and an initial end point value corresponding to the IP address range. In order to obtain the scanning address randomly in the follow-up, the present invention generates a random value through an operation method, but the IP address cannot be used for direct operation, so this step is to convert the IP address to facilitate the subsequent operation. The step is to know what the Internet Protocol (IP address) range is, and the initial start value and initial end point value of the corresponding IP address range can be obtained by calculation.

In step S103, the initial start point value and the initial end point value are transformed into a new start point value and a new end point value using a normalization function. The previous step is to convert the IP address range into numerical values, but the values of different data will have different values after conversion. In order to make each calculation consistent, this step uses standardized functions to convert the initial starting point value and The initial end point value is converted to a new start point value and a new end point value.

In one embodiment, the normalization function subtracts a value from the initial starting point value to make the new starting point value 1, i.e. basically, whatever the initial starting point value is, converts it to a value of 1 , so a value will be subtracted from the initial starting point value, and this value will be used later in reverse derivation.

In step S104, a first prime number greater than the new end point value, a random number between the new start point value and the new end point value, and a second prime number smaller than the first prime number are obtained for calculation, to produces a remainder. This step is the operation of taking random values, by obtaining a prime number greater than the new end point value, a random number between the new start point value and the new end point value, and another prime number smaller than the aforementioned prime number to perform the operation and generate a remainder.

In one embodiment, the operation of the first prime number, the random number and the second prime number includes multiplying the random number by the second prime number, and then dividing by the first prime number to obtain the remainder. In other words, the specific operation for obtaining the remainder is to multiply the random number by the second prime number and then divide by the first prime number to obtain the remainder.

In step S105, the remainder is converted into an IP address within the IP address range by using a denormalization function. In this step, the remainder obtained in the previous step is deduced by using the denormalization function to obtain the original IP address corresponding to the remainder, and the IP address is a randomly obtained IP address.

In one embodiment, the denormalization function is to add the remainder to the value obtained during normalization to generate a denormalized sequence. In short, in step S103, a value is subtracted from the initial starting point value to meet the standardization requirement, and this step adds back the value to achieve the purpose of reversely deriving the IP address.

In addition, after the aforementioned denormalized sequence is converted into binary, it will be converted into the IP address again. Step S105 uses the denormalization function to convert the remainder into a corresponding IP address, including converting the denormalized sequence into binary before converting it into an IP address. As for the conversion and other procedures, the following will be explained through specific examples.

It is understandable that there is certainly more than one device for risk detection. It not only includes many devices and each has its own IP address, the above-mentioned remainder is only calculated for the first device, and subsequent operations will be performed to find the second first device, third device, etc. Its specific method is after generating the remainder, multiplying the remainder by the second prime number, and then dividing by the first prime number to obtain the next remainder, and then repeatedly performing the above operations until the next remainder equal to Up to the remainder, the remainder refers to the first remainder obtained at the beginning. Similarly, the remainder, the next remainder, and all remainders up to the next remainder will be transformed by the inverse normalization function in sequence Then it becomes a sequence of IP addresses, that is to say, the scanning sequence is based on the IP addresses corresponding to the remainders calculated each time, and stops until the remainders generated at the end are equal to the remainders at the beginning.

In addition, the pre-processing method of the nuclear network risk detection of the present invention further includes performing risk detection scanning on several IP addresses in the array in sequence. The purpose of the present invention is to carry out the detection of nuclear network risk, so all the remainders obtained in the previous steps are converted to the IP address obtained, and the scanning of risk detection will be carried out in order, which can achieve random arrangement and complete analysis of all Internet The result of scanning the protocol address.

FIG. 2 is a system architecture diagram of the nuclear network risk detection system of the present invention. As shown in the figure, the nuclear network risk detection system 2 is used for nuclear network risk detection. In order to reduce network congestion, packet loss, and excessive consumption of system resources, and to avoid being mistaken for violent table scanning attacks, The nuclear network risk detection system 2 achieves the purpose of randomly arranging the IP addresses to be scanned through data pre-processing. Among them, the nuclear network risk detection system 2 of the present invention mainly includes an IP address slicing module 21 and a sub-scanning module 22 .

The IP address slicing module 21 is used for performing data pre-processing, and includes a value conversion unit 211 , a normalization unit 212 , a remainder unit 213 and a denormalization unit 214 .

The value conversion unit 211 is used for performing value conversion on the received IP address range to be scanned, so as to generate an initial start point value and an initial end point value corresponding to the IP address range. In order to obtain the scanning address at random in the follow-up, the value conversion unit 211 performs value conversion on the IP address to facilitate subsequent calculations. After knowing the range of the Internet Protocol (IP address), the initial value of the IP address range is obtained through calculation. Start value and initial end value.

The normalization unit 212 is used for converting the initial start point value and the initial end point value into a new start point value and a new end point value through a normalization function. In order to make each calculation consistent, the standardization unit 212 converts the initial start point value and the initial end point value using a standardization function to generate a new start point value and a new end point value.

In one embodiment, the normalization function subtracts a value from the initial starting point value to make the new starting point value 1, that is, after subtracting a value from the initial starting point value, the initial starting point value is converted into a value of 1 , in addition, the value subtracted from the initial starting point value will also be used later in back-calculation and restoration.

The remainder unit 213 is used to perform calculations based on a first prime number greater than the new end point value, a random number between the new start point value and the new end point value, and a second prime number smaller than the first prime number , to produce the remainder. In short, the remainder unit 213 performs the operation of taking random values, by obtaining a prime number greater than the new end point value, a random number between the new start point value and the new end point value, and another prime number smaller than the aforementioned prime number An operation performed on a prime number produces a remainder. Specifically In other words, a first prime number greater than the new end point value, a random number between the new start point value and the new end point value, and a second prime number smaller than the first prime number can be obtained for calculation, including combining the random number with After the second prime number is multiplied and then divided by the first prime number, the remainder can be obtained

The denormalization unit 214 is used for converting the remainder into an IP address within the IP address range through a denormalization function. The denormal function adds the remainder to the value to generate a denormalized sequence. The denormalization unit 214 uses the denormalization function to deduce the remainder obtained by the remainder unit 213 to obtain the original IP address corresponding to the remainder. Specifically, the remainder is added back to the standardization unit 212 for normalization The value used by the function to achieve the purpose of reversing the IP address.

In addition, the denormalized array will first be converted into binary before being converted into the IP address.

Since there is more than one device for risk detection, and each device has its own IP address, the remainder obtained for the first time is only calculated for the first device, and will be recalculated later to find the second device, the third other equipment such as equipment, so the remainder unit 213 includes taking the remainder as the next random number, generating the next remainder in the same operation mode until the next remainder equal to the remainder, and making the remainder, The next remainder and all remainders up to the last generated next remainder are sequentially transformed by the denormalization function into the sequence of IP addresses. In short, use the remainder generated for the first time to continue the operation, multiply the remainder by the second prime number, and then divide it by the first prime number to obtain the next remainder, and repeat the above operations until the last prime number is generated Until the next remainder is equal to the remainder, in this way, the remainder, the next remainder, and all remainders until the next remainder will be generated in sequence, and converted by the denormalization function will become a sequence of Internet protocol addresses, from the above It can be seen that the scanning order is According to the IP address corresponding to the remainder calculated each time, it does not stop until the remainder generated at the end is equal to the remainder at the beginning.

The sub-scanning module 22 is used for scanning the IP addresses for risk detection. Specifically, the sub-scanning module 22 performs risk detection scanning for the several IP addresses in the array sequentially.

Fig. 3 is a flow chart of a specific embodiment of the pre-processing method for nuclear network risk detection of the present invention. The present invention proposes a fast and accurate risk detection method. If the prior art is adopted, each IP address is simply checked in numerical order, which may cause serious blockage, delay or even loss of many packets in the local area network. In order to avoid In this case, the IP address slicing module of the present invention can randomly arrange and scan addresses. To select a smaller random sample of the address space, we only need to scan a subset of the complete arrangement. Therefore, the present invention randomly arranges the IP addresses to be scanned by pre-processing before scanning, so as to quickly perform scanning within the range of the Internet, and can also effectively bypass the hardware or software protection of the scanning target to detect a large amount of violence. Sweep table scan attack.

The detailed flow chart is shown in Figure 3. First, in process S310, the IP address range to be scanned is input, because the IP address range to be scanned will be converted later, the present invention proposes two different IP address input conversions method, and in response to future IPv6 may replace IPv4, so the present invention can also support intranet IPv6 algorithm.

In the IPv4 part, two conversion methods can be included. _The first conversion method is to _{enter the process} S320 , assuming that the IP address _{range of a} scan is X ₁ . End point E, starting point H=X ₁ * 2 ²⁴ +X ₂ * 2 ¹⁶ +X ₃ * 2 ⁸ +X ₄ * 2 ⁰ , end point E=Y ₁ * 2 ²⁴ +Y ₂ * 2 ¹⁶ +Y ₃ * 2 ⁸ +Y ₄ * 2 ⁰ .

，&為程式中轉化為二進位制的及閘，接著，K轉成十進位制得到H，即H=(K)₁₀，H即為所欲掃描的IP地址範圍之起點，終點E為H+2^32-D -1，其中，

經化簡後可得2³²-2^32-D 。 The second conversion method is _the process S330, assuming that the IP address range of a scan is P _{1 .} P ₂ . = P ₁ * 2 ²⁴ + P ₂ * 2 ¹⁶ + P ₃ * 2 ⁸ + P ₄ * 2 ⁰ to find T, let K be T &

, & is the gate that is converted into binary system in the program, and then, K is converted into decimal system to obtain H, that is, H=(K) ₁₀ , H is the starting point of the IP address range to be scanned, and the end point E is H +2 ^{32- D} -1, where,

After simplification, 2 ³² -2 ^{32- D} can be obtained.

，終點

16^32-i 。 For the IPv6 part, when using the first conversion method, it is assumed that the scanned IP address range is X ₁ X ₂ X ₃ X ₄ : X ₅ X ₆ X ₇ X ₈ : X ₉ X ₁₀ X ₁₁ X ₁₂ : X ₁₃ X ₁₄ X ₁₅ X ₁₆ : X ₁₇ X ₁₈ X ₁₉ X ₂₀ : X ₂₁ X ₂₂ X ₂₃ X ₂₄ : X ₂₅ X ₂₆ X ₂₇ X ₂₈ : X ₂₉ X ₃₀ X ₃₁ X ₃₂ to Y ₁ Y ₂ Y ₃ Y ₄ : Y ₅ Y ₆ Y ₇ Y _{8 :} Y ₉ Y ₁₀ Y ₁₁ Y ₁₂ : Y ₁₃ Y ₁₄ Y ₁₅ Y ₁₆ : Y ₁₇ Y 18 Y ₁₉ Y ₂₀ : Y ₂₁ Y ₂₂ Y ₂₃ Y ₂₄ : Y ₂₅ Y ₂₆ Y ₂₇ Y ₂₈ : Y ₂₉ Y ₃₀ Y ₃₁ Y ₃₂ , calculate the starting point

,end

16 ^{32- i} .

，求出T，令K為T &

，其中，&為程式中轉化為二進位制的及閘，K轉成十進位制得到H，H即為所欲掃描的IP地址範圍之起點，終點E為H+16^32-D -1。 When using the second conversion method, it is assumed that a scan IP address range is P ₁ P ₂ P ₃ P ₄ : P ₅ P ₆ P ₇ P ₈ : P ₉ P ₁₀ P ₁₁ P ₁₂ : P ₁₃ P ₁₄ P ₁₅ P ₁₆ : P ₁₇ P ₁₈ P ₁₉ P ₂₀ : P ₂₁ P ₂₂ P ₂₃ P ₂₄ : P ₂₅ P ₂₆ P ₂₇ P ₂₈ : P ₂₉ P ₃₀ P ₃₁ P ₃₂ /D, bring it in

, find T, let K be T &

, where & is the AND gate converted into binary system in the program, K is converted into decimal system to obtain H, H is the starting point of the IP address range to be scanned, and the end point E is H+16 ^{32- D} -1.

If the scanned IP address range is not in the form 1 or 2, enter into the process S311 and require re-input of the correct IP range.

Propose the starting point H and the end point E obtained after the conversion of the aforementioned method, enter the process S340, let a normalization function be F(x)=x-(H-1), and scan the IP address range for the starting point H and the end point E to bring into the standardization function, a new starting point F(H) and a new ending point F(E) can be obtained.

Then enter the process S350-S370, namely the operation of the remainder, the process S350 is to calculate a certain prime number P greater than F(E), randomly select a value G from F(H)~F(E) (process S361) and less than The prime number Q of the prime number P (process S360) is multiplied to S, and finally, in the process S370, the remainder R ₀ is obtained by dividing S by the prime number P, and the value of R ₀ is recorded. Afterwards, in the process S380, reversely deduce the standardized function F to convert R ₀ +(H-1) back to the IP address, and then enter the process S390, and send the IP address to the sub-scanning module to start scanning. This is a cycle. That is, the first IP address to scan.

In order to obtain other subsequent IP addresses, then execute the remainder operation again, enter the process S371, multiply R ₀ by the prime number Q, and divide the result S ₁ by the prime number P to obtain the remainder R ₁ , enter the process S381, through reverse deduction The standardized function F converts R ₁ +(H-1) back to an IP address, and finally, enters the process S391 and sends it to the sub-scanning module for scanning. This is the second loop. After each cycle, enter the process S400, judge R _n = R ₀ , if not, enter the process S401, that is, return to the process S371, calculate the next remainder, after repeated iterations, when R _n = R ₀ , this large cycle ends, and the present invention allows only four integers to be used to store the selected permutation and process through four integers when sending the schedule. A scanned address as well as the current address.

Expand R to R _{n -1} as a sequence, and the obtained sequence is a random sequence of all integers less than the prime number P. Denormalize this sequence and convert it into a binary IP address, and you will get the desired scan range Randomly arrange IP addresses, as shown in Figure 4, we compare the sequence 1 to 10 to the IP address to be scanned and standardized, choose a prime number greater than 10 P=11, randomly select a number 4 from 1 to 10 and less than Multiply a prime number Q=7 of the prime number P, get the result S=28, divide it by the prime number P, and get the remainder R ₀ =6; then multiply R ₀ by the prime number Q and divide it by the prime number 11, and get the remainder R ₁ = 9. After repeated iterations, the sequence of R ₀ ~ R ₁₀ can be obtained as [6, 9, 8, 1, 7, 5, 2, 3, 10, 4, 6]. Since R ₀ = R ₁₀ , the iteration At the end, the obtained sequence R ₀ ~ R ₉ is a sequence of random arrangement smaller than the prime number P. Since the calculated random IP address will be sent to each sub-scanning module to start scanning, there is no need to record the randomly arranged IP addresses within the desired scanning range, which will greatly reduce the memory space of the system.

In view of the ever-increasing network assets of the enterprise intranet, the importance of asset management and intranet security is increasing day by day. This invention proposes to scan the company's internal network or associated network domains in groups through the IP address slicing module. The following is an example For illustration, for example, 172.10.0.1 to 173.10.1.252 are all company intranets or associated domains, and the above two methods are used for conversion and calculation.

In the first conversion method, assuming that a scanning IP address range is 172.10.0.1 to 173.10.1.252, the calculation start point H=172 * 2 ²⁴ +10 * 2 ¹⁶ +0 * 2 ⁸ +1 * 2 ⁰ , the end point E= 173 * 2 ²⁴ +10 * 2 ¹⁶ +1 * 2 ⁸ +252 * 2 ⁰ , the starting point H=2886336513 and the ending point E=2903114236.

Put forward the starting point H and end point E obtained after the conversion of the above method, let a normalization function be F(x)=x-2886336512, scan the IP address range as the starting point H and the end point E into the normalization function, you can get F( H)=1 and F(E)=16777724, then, calculate a certain prime number P=16777729 greater than F(E) (you can also fix P to 4294967311=2^32+15, but it will increase the amount of calculation, and then Add a little computing time), randomly select a value 9624327 from F(H)~F(E) and multiply it with a prime number Q=97 smaller than the prime number P to get S, and finally divide S by prime number P to get the remainder R ₀ =10784624, And record the value of R ₀ , and then use the inverse normalization function F to convert R ₀ +2886336512 back to the IP address to get 172.174.143.112, which can be sent to the sub-scanning module to start scanning. This is a cycle.

Afterwards, multiply R ₀ by the prime number Q to obtain the result S ₁ divided by the prime number P to obtain the remainder R ₁ =5889330, and convert R ₁ +2886336512 back to an IP address by inverting the standardized function F to obtain 172.99.221.50, and send Go to the sub-scanning module to scan, this is the second cycle. After repeated iterations, when R _n = R ₀ , this large cycle ends. As mentioned above, only four integers are used to store the selected arrangement and subsequent processing, and the four integers store the prime number Q and the prime number P respectively. , the address of the first scan and the current address.

After repeated iterations, the obtained remainder can become a sequence, that is, the R sequence is [10784624, 5889330, 822224, 12644812, 1772547, 4159769, 832097, ...], after denormalization, the denormalized sequence is [2897121136, 2892225842 , 2887158736, 2898981324, 2888109059, 289049628, ...], followed by binary conversion, the converted binary sequence is [10101100.10101110.10001111.01110000, 10101100.01100011.1101110101010101010 10110.10001011.11010000, 10101100.11001010.11110001.11001100, ...], and finally, convert the binary value to IP address, after conversion, the IP address sequence is [172.174.143.112, 172.99.221.50, 172.22.139.208, 172.202.241.204, ...], which can be provided to the sub-scanning module for scanning.

，&為程式中轉化為二進位制的及閘，令X為

，化簡後可得2³²-2⁷=4294967168，即T的二進位制為11000000101010000000000000100000，X的二進位制為11111111111111111111111110000000，計算後得到的K為 11000000101010000000000000000000，K轉成十進位制，可得到H=3232235520，H即為所欲掃描的IP地址範圍之起點，計算後可得終點E為3232235647。 In the second conversion method, it is assumed that a scanning IP address range is 192.168.0.32/25, and it is brought into T=192 * 2 ²⁴ +168 * 2 ¹⁶ +0 * 2 ⁸ +32 * 2 ⁰ to obtain T= 3232235552, let K be T &

, & is the AND gate converted into binary system in the program, let X be

, after simplification, we can get 2 ³² -2 ⁷ =4294967168, that is, the binary system of T is 11000000101010000000000000100000, the binary system of X is 1111111111111111111111110000000, and the K obtained after calculation is 110000000100000 00, K is converted into decimal system, and H= 3232235520, H is the starting point of the IP address range to be scanned, after calculation, the end point E is 3232235647.

Put forward the starting point H and the ending point E obtained after the conversion of the above method, let a normalization function be F(x)=x-3232235519, scan the IP address range as the starting point H and the ending point E into the normalization function, you can get F( H)=1 and F(E)=128, then, calculate a certain prime number P=131 greater than F(E), randomly select a prime number with a value of 70 and less than the prime number P from F(H)~F(E) Multiply Q=97 to get S, and finally divide S by the prime number P to get the remainder R ₀ =109, and record the value of R ₀ , and then use the inverse normalization function F to convert R ₀ +3232235519 back to the IP address to get 192.168 .0.108, it can be sent to the sub-scanning module to start scanning, which is a cycle.

Afterwards, multiply R ₀ by the prime number Q to obtain the result S ₁ divided by the prime number P to obtain the remainder R ₁ =93, use the inverse normalization function F to convert R ₁ +3232235519 back to the IP address and send it to the sub-scan module group to scan, this is the second cycle. After repeated iterations, when R _n = R ₀ , this large cycle ends. Similarly, only four integers are used to store the selected arrangement and subsequent processing, and the four integers store the prime number Q, the prime number P, the first A scanned address and the current address.

After repeated iterations, the obtained remainder can become a sequence, that is, the R sequence is [109, 93, 113, 88, 21, 72, 41, 47, 105, 98, ...]. After denormalization, denormalization The sequence is [3232235628, 3232235612, 3232235632, 3232235607, 3232235540, 3232235591, ...], and then converted into a binary sequence [11000000.10101000.00000000.01101100, 11000.0000. .01011100, 11000000.10101000.00000000.01110000, 11000000.10101000.00000000.01010111, 11000000.10101000.00000000.00010100, ...], and finally, Then convert the binary value into an IP address, and the converted IP address is listed as [192.168.0.108, 192.168.0.92, 192.168.0.112, 192.168.0.87, 192.168.0.20, ...], which can be provided to the sub-scanning module for scanning.

Therefore, the present invention can carry out pre-processing before nuclear network risk detection, and randomly arrange the IP addresses to be scanned by mathematical operations, so as to quickly perform scanning within the Internet range, and can effectively bypass the scanning target hardware Or software protection to detect a large number of brute force table scanning attacks.

In addition, the present invention also discloses a computer-readable medium, which is applied to a computing device or computer having a processor (for example, CPU, GPU, etc.) and/or memory, and stores instructions, and can be used by this computing device or The computer executes the computer-readable medium through the processor and/or memory, so as to execute the above-mentioned method and each step when executing the computer-readable medium.

The module, unit, device, etc. of the present invention include a microprocessor and a memory, and algorithms, data, programs, etc. are stored in the memory or a chip, and the microprocessor can load data or algorithms or programs from the memory to perform Processing such as data analysis or calculation will not be repeated here. In other words, the nuclear network risk detection system of the present invention can be executed on electronic equipment, such as a general computer, tablet or server, and perform data analysis and calculation after receiving the IP address range to be scanned input by the user , so the program of the nuclear network risk detection system can be designed and built on electronic devices with processors, memory and other components through software, so as to run on various electronic devices; in addition, the nuclear network risk detection system can also be The IP address slicing module and the denormalization unit are respectively composed of independent components, such as being designed as a calculator, a memory, a storage device or a firmware with a processing unit, all of which can become components of the present invention, and the value conversion Units, normalization units, remainder units, and denormalization units may also optionally be presented as software programs, hardware or firmware architectures.

In summary, the nuclear network risk detection pre-processing method, system and computer-readable medium of the present invention use mathematical operations to randomly arrange the IP addresses to be scanned, and then transmit them to the sub-scanning module Scanning is performed to quickly scan the loopholes in the entire network segment within the enterprise in a horizontal manner. Therefore, the present invention can achieve the following technical effects.

The present invention converts the network segment to be scanned and combines the prime number characteristic operation, which can effectively disperse the scanning network segment, avoiding the loss of packets caused by congestion or delay between a single host and the regional network, and then affecting the correctness and integrity of loophole detection.

Compared with the past random scanners that need to use a list to record the random IP addresses to be scanned, this invention randomly arranges the IP addresses to be scanned through mathematical operations, and after calculating the random IP addresses, it will be handed over to the scanner for scanning without Using system resources to record random numbers can greatly reduce memory resources. While saving memory resources, it will not repeatedly scan or miss hosts to be scanned.

Compared with the previous step-by-step scanners that scan IP addresses one by one in sequence, this patent randomly arranges the IP addresses to be scanned through mathematical operations, which can effectively bypass the hardware or software protection detection of the scanning target and a large number of violent table scanning methods Scan attack.

The above-mentioned embodiments are only illustrative to illustrate the principles and effects of the present invention, and are not intended to limit the present invention. Anyone skilled in the art can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the rights of the present invention should be listed in the scope of the patent application described later.

S101~S105: steps

Claims (14)

A pre-processing method for nuclear network risk detection, including: receiving the IP address range to be scanned; converting the IP address range to generate an initial starting point value and an initial value corresponding to the IP address range End point value; convert the initial start point value and the initial end point value into a new start point value and a new end point value by a normalization function; obtain a first prime number greater than the new end point value, and a value between the new start point value and a random number between the new endpoint value and a second prime number less than the first prime number to generate a remainder; Protocol address, wherein, after the operation of the first prime number, the random number and the second prime number, the corresponding IP address is found from the IP address range according to the remainder, so as to repeatedly execute the remainder After the operation, the IP addresses to be scanned are randomly found and arranged. The pre-processing method for nuclear network risk detection according to claim 1, wherein the normalization function is to subtract a value from the initial starting point value, so that the new starting point value becomes 1. The pre-processing method for nuclear network risk detection according to Claim 2, wherein the denormalization function adds the remainder to the value to generate a denormalization sequence. The pre-processing method for nuclear network risk detection as described in Claim 3, wherein the denormalized sequence is converted into binary, and then converted into the IP address. The pre-processing method for nuclear network risk detection as described in Claim 1, wherein the operation of the first prime number, the random number and the second prime number includes multiplying the random number by the second prime number, Then divide by the first prime number to obtain the remainder. The pre-processing method for nuclear network risk detection as described in Claim 1, wherein, after generating the remainder, further comprising: multiplying the remainder by the second prime number, and then dividing by the first prime number to obtain the following a remainder; and performing the above operations repeatedly until the last resulting next remainder is equal to the remainder, wherein the remainder, the next remainder, and all remainders up to the last resulting next remainder are sequentially subjected to the denormalization After the function is converted, it becomes an array of the IP address. The pre-processing method for nuclear network risk detection as described in claim item 6 further includes: performing risk detection scanning on several IP addresses in the array in sequence. A computer-readable medium, applied to a computing device or a computer, storing instructions to execute the pre-processing method for nuclear network risk detection as described in any one of claims 1 to 7. A nuclear network risk detection system, comprising: an IP address slicing module, including: a numerical conversion unit, which is used to convert the received IP address range to be scanned, so as to generate the corresponding IP address The initial starting point value and the initial ending point value of the address range; the normalization unit is used to convert the initial starting point value and the initial ending point value into a new starting point value and a new ending point value through a normalization function; taking the remainder unit, the system Used to generate a remainder based on a first prime number greater than the new end point value, a random number between the new start point value and the new end point value, and a second prime number smaller than the first prime number ;as well as The denormalization unit is used to convert the remainder into an IP address within the IP address range through a denormalization function, wherein, according to the remainder, the corresponding IP address is found from within the IP address range IP address, so that after repeatedly performing the operation of the remainder, the IP address to be scanned is randomly found and arranged; and the sub-scanning module is used to scan the IP address for risk detection . The nuclear network risk detection system as described in claim item 9, wherein, the remainder unit further includes taking the remainder as the next random number, and generating the next remainder in the same operation until the last remainder is equal to the until the remainder, and make the remainder, the next remainder, and all remainders up to the last generated next remainder sequentially transformed by the denormalization function into the sequence of the IP address. The nuclear network risk detection system according to claim 10, wherein the sub-scanning module performs risk detection sequentially on several IP addresses in the array. The nuclear network risk detection system according to claim 9, wherein the normalization function is to subtract a value from the initial starting point value, so that the new starting point value becomes 1. The nuclear network risk detection system as claimed in claim 12, wherein the denormalization function is to add the remainder to the numerical value to generate a denormalization sequence. The nuclear network risk detection system according to claim 13, wherein the denormalized sequence is converted into binary and then converted into the IP address.

Images