WO2019140876A1

WO2019140876A1 - Method for establishing phantom device capable of network attack prevention, medium, and device

Info

Publication number: WO2019140876A1
Application number: PCT/CN2018/096106
Authority: WO
Inventors: 肖政; 涂大志; 戴昌
Original assignee: 深圳市联软科技股份有限公司
Priority date: 2018-01-22
Filing date: 2018-07-18
Publication date: 2019-07-25
Also published as: CN108322456A

Abstract

A method for establishing a phantom device capable of network attack prevention, a medium, and a device. The method comprises: obtaining features of real devices in a local area network; classifying the real devices according to the features, and separately using each type of real devices as a device template; setting a configuration file of a phantom device according to the device template; and loading the configuration file to generate the phantom device. A phantom device generated with the method of the present invention is highly similar to a corresponding real device and thus can be perfectly camouflaged in a network, so that high-simulation camouflage is achieved and a network attack can be promptly and effectively sensed, and trapped or warned and evidenced; furthermore, the phantom device established in this way is simple in deployment and use, less in consumed computer and human resources, and low in requirements for security expertise of deployment and maintenance personnel.

Description

Method, medium and device for establishing phantom device for preventing network attack

Technical field

The present invention relates to the field of network security technologies, and in particular, to a method, a medium, and a device for establishing a phantom device for preventing network attacks.

Background technique

Active defensive technology such as honeynet honeypot, honeynet is a network system, not a single host, this network system is hidden behind the firewall, all incoming and outgoing data is monitored, captured and controlled; honeypot technology It is a technique for spoofing an attacker. By arranging some hosts, network services or information as bait, the attacker is induced to attack them, so that the attack behavior can be captured and analyzed to understand the tools used by the attacker. And methods, speculating on the intent and motivation of the attack, can enable the defenders to clearly understand the security threats they face, and enhance the security protection of the actual system through technical and management means; these active defense technologies can effectively perceive and capture the botnet. Automatic attacks such as scripts, but the camouflage techniques in the prior art are not well camouflaged, and are easily seen by attackers. The traps are easily circumvented and the defense ability is poor. At the same time, the deployment and maintenance of the active defense technology such as the traditional honeypot honeypot is highly demanding on the safety professional skills of personnel.

Summary of the invention

The application provides a method, a medium and a device for establishing a phantom device for preventing network attacks, and the established phantom device can be perfectly camouflaged into the network, and has strong defense capability.

In a first aspect, the present application provides a method for establishing a phantom device for preventing network attacks, including:

Obtaining the characteristics of real devices in the local area network;

According to the feature, the real device is classified, and each type of the real device is used as a device template;

Setting a configuration file of the phantom device according to the device template;

The configuration file is loaded to generate the phantom device.

Preferably, the setting, according to the device template, a configuration file of the phantom device, includes:

Assigning an IP address and a MAC address to each phantom device according to the device template;

And setting a configuration file of the corresponding phantom device according to the IP, the MAC address, and the feature corresponding to the device template. Preferably, the assigning an IP address and a MAC address to each phantom device according to the device template includes:

Counting the number of real devices corresponding to each of the device templates;

Calculating, according to the preset number of devices, a number of phantom devices corresponding to each of the device templates according to the preset number of devices;

Calculating an alternative IP according to the IP of the real device;

Selecting, according to the number of phantom devices, a corresponding number of IPs from the candidate IP for the device template;

Generating a MAC address of the corresponding phantom device according to the vendor characteristics of the device template.

Preferably, the configuration file of the corresponding phantom device is set according to the IP, the MAC address, and the feature corresponding to the device template, including:

Setting corresponding features of the phantom device according to characteristics of the device template;

Setting a corresponding IP for the phantom device according to the IP;

Setting a corresponding MAC address for the phantom device according to the MAC address;

A profile of the phantom device is generated according to the set characteristics, IP, and MAC address of the phantom device.

Preferably, the setting corresponding to the phantom device according to the feature of the device template includes:

The open port of the phantom device is set to a proxy mode according to an open port feature of the device module.

Preferably, the method further comprises:

Real-time monitoring of the real device that is newly launched;

Detecting whether the IP and MAC address of the real device conflict with the IP and MAC address of the phantom device; if not, continuing to monitor the new device that is online;

If the conflict occurs, determining whether the IP of the real device conflicts with the IP of the phantom device;

If the IP of the real device conflicts with the IP of the phantom device, the phantom device corresponding to the IP is disabled, and the record of the phantom device is deleted; the configuration file corresponding to the phantom device is modified, and the modified The configuration file, updating the phantom device;

If the IP of the real device does not conflict with the IP of the phantom device, determining whether the MAC address of the real device conflicts with the MAC address of the phantom device;

If the MAC address of the real device conflicts with the MAC address of the phantom device, reselecting a MAC address for the phantom device; updating the MAC address of the phantom device according to the reselected MAC address;

If the MAC address of the real device does not conflict with the MAC address of the phantom device, the new device that is newly online is continuously monitored.

Preferably, the method further comprises:

Determining whether the phantom device has reached a refresh cycle;

If yes, re-execute the steps of establishing a phantom device;

If not, continue to use the phantom device.

In a second aspect, the present application provides a method for preventing network attacks, including:

Real-time monitoring of communication information of a phantom device in a local area network; wherein the phantom device is established by the method described in the first aspect;

Determining whether there are other devices communicating with the phantom device;

If not, continue to monitor the communication information of the phantom device;

If so, mark the other device as a suspicious device;

Blocking communication between the suspicious device and the phantom device and the real device in the local area network, and transmitting the information of the suspicious device to a network administrator.

Preferably, the method further comprises: continuously monitoring the suspicious device while blocking communication between the suspect device and the phantom device and the real device in the local area network.

Preferably, the method further includes: collecting the risk information of the phantom device in real time after the phantom device is established, and transmitting the risk information to the user.

In a third aspect, in conjunction with the first aspect, the present application provides a computer readable storage medium having stored thereon a computer program executed by a processor to implement the phantom device for preventing network attacks according to the first aspect. method.

In a fourth aspect, in conjunction with the first aspect, the present application provides a computer device comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the program to implement The method for establishing a phantom device for preventing network attacks according to the first aspect.

The present application provides a method for establishing a phantom device for preventing network attacks, comprising: acquiring features of real devices in a local area network; classifying the real devices according to the features, and using each type of the real devices as a type a device template, configured to set a configuration file of the phantom device according to the device template, and load the configuration file to generate the phantom device. Since each device template has the same characteristics as the real device, the phantom device configuration file is set according to the device template, and the phantom device is generated according to the configuration file, so that the generated phantom device has high similarity with the corresponding real device, and can be perfect. It is disguised into the network to achieve high emulation camouflage, timely and effectively perceive network attacks and conduct trapping or alarm forensics. At the same time, the phantom device thus established is simple to deploy and use, consumes less computer resources and human resources, and is deployed and maintained. The safety and technical requirements of personnel are not high.

The method for preventing network attacks provided by the present application has the same advantageous effects as the method for establishing the phantom device for preventing network attacks described above.

A computer readable storage medium and a computer device provided by the present application have the same beneficial effects as the above-described phantom device establishment method for preventing network attacks.

DRAWINGS

In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the specific embodiments or the description of the prior art will be briefly described below. In all the figures, like elements or parts are generally identified by like reference numerals. In the figures, elements or parts are not necessarily drawn to scale.

1 is a flowchart of a method for establishing a phantom device for preventing network attacks according to the present invention;

2 is a flowchart of a method for preventing network attacks according to the present invention;

FIG. 3 is a schematic structural diagram of a computer device according to the present invention.

Detailed ways

The embodiments of the technical solution of the present invention will be described in detail below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention, and thus are merely exemplary and are not intended to limit the scope of the present invention.

It should be noted that the technical terms or scientific terms used herein should be used in the ordinary meaning as understood by those skilled in the art to which the invention belongs, unless otherwise stated.

The invention provides a phantom device establishment method, a medium, a device and an anti-network attack method for preventing network attacks. Embodiments of the present invention will be described below with reference to the accompanying drawings.

First embodiment:

Please refer to FIG. 1 . FIG. 1 is a flowchart of a method for establishing a phantom device for preventing network attacks according to an embodiment of the present invention.

Step S101: Acquire a feature of a real device in the local area network.

Step S102: According to the feature, classify the real device, and use each type of the real device as a device template.

Step S103: Set a configuration file of the phantom device according to the device template.

Step S104: Load the configuration file to generate the phantom device.

The features may include: device type, operating system, operating system fingerprint, open port, vendor feature, and the like.

According to the feature, each real device in the local area network is classified, and one category corresponds to one device template. For example, an operating system corresponds to a category.

In the present invention, a phantom device refers to a masquerading system that prevents a network from attacking a real device.

Since each device template has the same characteristics as the real device, the phantom device configuration file is set according to the device template, and the phantom device is generated according to the configuration file, so that the generated phantom device has high similarity with the corresponding real device, and can be perfect. The camouflage into the network, realize high simulation camouflage, timely and effectively perceive network attacks and conduct trapping or alarm forensics; at the same time, the phantom device thus established is simple to deploy and use, and consumes less computer resources and human resources.

In a specific embodiment of the present invention, the setting a configuration file of the phantom device according to the device template includes: assigning an IP (Internet Protocol) and a MAC (Media Access) to each phantom device according to the device template. Control or Medium Access Control) address; set a configuration file of the corresponding phantom device according to the IP, MAC address, and the feature corresponding to the device template.

The MAC address can be a physical address or a hardware address.

After classifying the real devices, you need to save the feature backup of each device template.

When setting up a configuration file, the important parameters are IP and MAC addresses. In the configuration file, not only the IP address and MAC address must be set, but also other parameters, such as operating system fingerprint, operating system, open port, etc., need to be set according to multiple characteristics. By setting a profile based on multiple features, it is possible to obtain a phantom device that is highly similar to a real device, improving the similarity of the phantom device.

In the present invention, the assigning an IP address and a MAC address to each phantom device according to the device template includes: counting the number of real devices corresponding to each device template; and based on the number of real devices, according to a preset magnification Calculating a number of phantom devices corresponding to each of the device templates; calculating an alternative IP according to the IP of the real device; and selecting a corresponding quantity from the candidate IP for the device template according to the phantom device number IP; generates a MAC address of the corresponding phantom device according to the vendor characteristics of the device template.

When assigning IP addresses and MAC addresses to each phantom device, you need to count the number of real devices corresponding to each device template in the LAN, and calculate the number of phantom devices corresponding to each device template to be established according to the preset magnification. Then, according to the IP of the real device, combined with the idle IP stored in the storage device and the newly calculated IP, the alternative IP of the phantom device is selected such that the alternative IP is different from the IP of the real device. Among them, when selecting IP, you need to select the corresponding number of IPs for each device template, and each phantom device must correspond to one IP. Finally, the MAC address is generated according to the vendor characteristics of the device template, where the vendor feature of the device template is the vendor feature of the corresponding real device. The generated phantom device has a different MAC address than the real device's MAC address, and each phantom device has a different MAC address.

By assigning IP and MAC addresses to the phantom devices in this way, the background staff can distinguish between real devices and phantom devices, and at the same time, improve the similarity between phantom devices and real devices. Moreover, in this way, the number of phantom devices can be adjusted according to the actual needs of different intranet levels, and the scalability is strong.

In a specific embodiment of the present invention, setting a configuration file of the corresponding phantom device according to the IP, the MAC address, and the feature corresponding to the device template, including: setting a phantom device according to the feature of the device template Corresponding features; setting a corresponding IP for the phantom device according to the IP; setting a corresponding MAC address for the phantom device according to the MAC address; according to the feature of the phantom device, IP And a MAC address, generating a configuration file of the phantom device.

After assigning IP and MAC addresses to each phantom device, you need to set the configuration file according to the characteristics, IP and MAC address of the device template corresponding to each phantom device.

First, you need to create a template for the configuration file of the phantom device, and set the corresponding parameters of the configuration file according to the characteristics of the corresponding device template saved in advance, for example, the operating system and the response action to the TCP/UDP/ICMP packet (reset/closed) /open, etc.), operating system fingerprints, open ports, etc.

Among them, when setting the open port, the port supported by the phantom device such as 22, 80 is configured as the proxy mode, and the proxy service points to the IP and port of the phantom device. The phantom device's emulation can be improved by setting the phantom device's open port to proxy mode.

Among them, you need to configure the corresponding script for the 21 ports to support the services that the phantom device is open on the corresponding port.

Then, according to the assigned IP, set the IP of the configuration file of the phantom device; and then set the MAC address of the configuration file of the phantom device according to the assigned MAC address.

Finally, a configuration file is generated based on the set parameters.

By generating a profile based on a plurality of features, IPs, and MAC addresses, the similarity of the phantom device generated from the profile to the real device can be improved.

In the present invention, when a profile is loaded to generate a phantom device, Honeyd can be used to load a profile to generate a phantom device. Among them, Honeyd is an open source software for generating virtual honeypots.

In a specific embodiment provided by the present invention, after the step of generating the phantom device, the method further includes: monitoring a real device that is newly online in real time; detecting whether an IP address and a MAC address of the real device are related to an IP of the phantom device And the MAC address conflicts; if there is no conflict, the device continues to listen to the new device that is online; if the conflict occurs, it is determined whether the IP of the real device conflicts with the IP of the phantom device; if the IP address of the real device Determining the IP conflict of the phantom device, deactivating the phantom device corresponding to the IP, and deleting the record of the phantom device; modifying the configuration file corresponding to the phantom device, loading the modified configuration file, and updating the phantom If the IP address of the real device does not conflict with the IP address of the phantom device, determine whether the MAC address of the real device conflicts with the MAC address of the phantom device; if the MAC address of the real device is If the MAC address of the phantom device conflicts, the MAC address is newly selected for the phantom device; and the MAC address of the phantom device is updated according to the reselected MAC address; MAC addresses of the phantom device apparatus does not conflict, then the device continues listening to the new on-line transactions.

After the phantom device is generated, the method further includes: detecting whether the IP address and the MAC address of the real device in the local area network conflict with the IP address and the MAC address of the phantom device, and if the conflict occurs, adjusting the parameter setting of the phantom device.

The specific detection process is:

Real-time monitoring of the real device on the new line; detecting whether the IP and MAC address of the real device conflict with the IP and MAC address of the phantom device; if there is no conflict, it continues to listen to the new device that is online.

If the conflict occurs, it is determined whether the IP of the real device conflicts with the IP of the phantom device; if the IP of the real device conflicts with the IP of the phantom device, the phantom device corresponding to the IP is disabled, and the record of the phantom device is deleted; the phantom is modified The configuration file corresponding to the device, load the modified configuration file, and update the phantom device. When loading the configuration file, use Honeyd to load the new configuration file.

If the IP of the real device does not conflict with the IP of the phantom device, it is determined whether the MAC address of the real device conflicts with the MAC address of the phantom device; if the MAC address of the real device conflicts with the MAC address of the phantom device, the phantom device is selected again. MAC address; update the MAC address of the phantom device according to the reselected MAC address; if the MAC address of the real device does not conflict with the MAC address of the phantom device, continue to listen to the new device that is online.

By monitoring real-time devices on the new line in real time, you can avoid confusing phantom devices with real devices and avoid monitoring errors when using phantom devices to prevent network attacks.

In a specific embodiment provided by the present invention, after the step of generating the phantom device, the method further includes: determining whether the phantom device has reached a refresh cycle; if yes, performing the step of establishing a phantom device; if not, continuing Use the phantom device.

After using the phantom device for a period of time, it is necessary to determine whether the phantom device has reached the refresh cycle. If not, the phantom device can continue to be used; if so, the phantom device needs to be deleted and a new phantom device is re-established. In this way, when the characteristics of the real device change, the phantom device that is not applicable can be deleted in time, the corresponding phantom device is established, and the phantom device is updated in time to better prevent the network from attacking the real device.

The refresh period can be determined based on the empirical value.

By the method of the invention, the advantages of the traditional honeypot honey net technology are fully absorbed, and a phantom device similar to the real device can be established, and the phantom device can be perfectly camouflaged into the real device in the network, and the network attack is timely and effectively perceived. Conduct trapping or alarm forensics. In addition, the present invention is simple to deploy and use, and the generation of these phantom devices in the internal network consumes a small amount of computer resources and saves resources. At the same time, the present invention can adjust the number of phantom devices according to the actual needs of different intranet levels, so that corresponding phantom devices can be provided for each real device.

The above is a method for establishing a phantom device for preventing network attacks provided by the present invention.

Second embodiment:

The present invention further provides a method for preventing network attacks. Referring to FIG. 2, it is a schematic diagram of a method for preventing network attacks according to an embodiment of the present invention.

A method for preventing network attacks provided by the second embodiment of the present invention includes:

Step S101: Real-time monitoring communication information of the phantom device in the local area network; wherein the phantom device is established by the method described in the first embodiment;

Step S102: determining whether another device communicates with the phantom device;

Step S103: If not, continue to monitor the communication information of the phantom device;

Step S104: If yes, mark the other device as a suspicious device;

Step S105: Block communication between the suspicious device and the phantom device and the real device in the local area network, and send the information of the suspicious device to a network administrator.

After the phantom device is generated, the phantom device needs to be spoofed into the real device. The phantom device can be used as a shadow of a real device, pretending to be a real device, and preventing the real device from being attacked. The phantom device prevents the network attack by: monitoring the communication information of the phantom device in the local area network in real time, determining whether other devices communicate with the phantom device, and if not, continuing to monitor the communication information of the phantom device; if any, the other The device is marked as a suspicious device; the suspicious device is blocked from communicating with the phantom device and the real device, so that the suspicious device cannot attack the real device. At the same time, the information of the suspicious device can also be sent to the network administrator, so that the network administrator can perform related processing according to the information of the suspicious device in time.

When it is detected that other devices communicate with the phantom device, the information of the discovered suspicious device can be sent to the network administrator through SMS/E-mail/SNMP Trap/syslog.

In blocking the communication command between the suspicious device and the phantom device, you can continue to monitor whether other devices communicate with the phantom device and continue to monitor the suspicious device.

In the present invention, the risk information of the phantom device may also be collected in real time; the risk information is sent to the user.

After the phantom device is established, the risk information of the phantom device can also be collected in real time, and the risk information is sent to the user for alerting and alerting the user to the risk of the phantom device.

When collecting risk information, you can use Honeyd to collect risk information from the phantom device.

Among them, the risk information may refer to information such as hacker attacks, communication between other devices and phantom devices.

By collecting the risk information of the phantom device, the risk information of the phantom device of the user can be promptly alerted.

Third embodiment:

In the above-mentioned first embodiment, a phantom device establishment method for preventing network attacks is provided. In combination with the above-described first embodiment, a third embodiment of the present invention provides a computer readable storage medium on which a computer program is stored. When the program is executed by the processor, the phantom device establishment method for preventing network attacks provided by the foregoing first embodiment is implemented.

Fourth embodiment:

In conjunction with the phantom device establishment method for preventing network attacks provided by the first embodiment, the present invention further provides a computer device, including: a memory, a processor, and a computer program stored on the memory and operable on the processor, The phantom device establishing method for preventing network attacks provided by the foregoing first embodiment is implemented when the processor executes the program. FIG. 3 is a schematic diagram showing the hardware structure of a computer device according to an embodiment of the present invention.

Specifically, the processor 201 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present invention. .

Memory 202 can include mass storage for data or instructions. By way of example and not limitation, the memory 202 may include a Hard Disk Drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive, or two or more. A combination of more than one of these. Memory 202 may include removable or non-removable (or fixed) media, where appropriate. Memory 202 may be internal or external to the data processing device, where appropriate. In a particular embodiment, memory 202 is a non-volatile solid state memory. In a particular embodiment, memory 202 includes a Read-Only Memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a Programmable Read-only Memory (PROM), an Erasable Programmable ROM (EPROM), or an electrically erasable PROM (Electrically Erasable Programmable). Read Only Memory (EEPROM), electrically rewritable ROM (EAROM) or flash memory or a combination of two or more of these.

The processor 201 implements the phantom device establishment method for preventing any network attack by reading and executing the computer program instructions stored in the memory 202.

In one example, the establishment device of the anti-network attack phantom device may further include a communication interface 203 and a bus 210. As shown in FIG. 2, the processor 201, the memory 202, and the communication interface 203 are connected by the bus 210 and complete communication with each other.

The communication interface 203 is mainly used to implement communication between modules, devices, units and/or devices in the embodiments of the present invention.

The bus 210 includes hardware, software, or both, and couples components of the phantom device-creating device that are resistant to network attacks to each other. By way of example and not limitation, the bus may include Accelerated Graphic Ports or Advanced Graphic Ports (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (Front Side Bus, FSB), HyperTransport (HT) interconnect, Industry Standard Architecture (ISA) bus, infinite bandwidth interconnect, Low Pin Count (LPC) bus, memory bus, microchannel architecture ( MicroChannel Architecture, MCA) Bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association (VESA local bus, VLB) bus or other suitable bus or a combination of two or more of these. Bus 210 may include one or more buses, where appropriate. Although specific embodiments of the present invention are described and illustrated, the present invention contemplates any suitable bus or interconnect.

It is to be understood that the invention is not limited to the specific configurations and processes described above and illustrated in the drawings. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps have been described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after the spirit of the invention.

The functional blocks shown in the above structural block diagram may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, plug-ins, function cards, and the like. When implemented in software, the elements of the present invention are programs or code segments that are used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted over a transmission medium or communication link through a data signal carried in the carrier. A "machine-readable medium" can include any medium that can store or transfer information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like. The code segments can be downloaded via a computer network such as the Internet, an intranet, and the like.

Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. The scope is intended to be included within the scope of the claims and the description of the invention.

Claims

A method for establishing a phantom device for preventing network attacks, comprising:

Obtaining the characteristics of real devices in the local area network;

According to the feature, the real device is classified, and each type of the real device is used as a device template;

Setting a configuration file of the phantom device according to the device template;

The configuration file is loaded to generate the phantom device.
The method according to claim 1, wherein the setting a configuration file of the phantom device according to the device template comprises:

Assigning an IP address and a MAC address to each phantom device according to the device template;

And setting a configuration file of the corresponding phantom device according to the IP, the MAC address, and the feature corresponding to the device template.
The method according to claim 2, wherein the assigning IP and MAC addresses to each phantom device according to the device template comprises:

Counting the number of real devices corresponding to each of the device templates;

Calculating, according to the preset number of devices, a number of phantom devices corresponding to each of the device templates according to the preset number of devices;

Calculating an alternative IP according to the IP of the real device;

Selecting, according to the number of phantom devices, a corresponding number of IPs from the candidate IP for the device template;

Generating a MAC address of the corresponding phantom device according to the vendor characteristics of the device template.
The method according to claim 2, wherein the configuration file of the corresponding phantom device is set according to the IP, the MAC address and the feature corresponding to the device template, including:

Setting corresponding features of the phantom device according to characteristics of the device template;

Setting a corresponding IP for the phantom device according to the IP;

Setting a corresponding MAC address for the phantom device according to the MAC address;

A profile of the phantom device is generated based on the characteristics, IP, and MAC address of the phantom device that is set.
The method according to claim 4, wherein the setting the corresponding feature of the phantom device according to the feature of the device template comprises:

The open port of the phantom device is set to a proxy mode according to an open port feature of the device module.
The method of claim 1 further comprising:

Real-time monitoring of real devices that are newly launched;

Detecting whether the IP address and the MAC address of the real device conflict with the IP address and the MAC address of the phantom device; if not, continuing to monitor the new device that is online;

If the conflict occurs, determining whether the IP of the real device conflicts with the IP of the phantom device;

If the IP of the real device conflicts with the IP of the phantom device, the phantom device corresponding to the IP is disabled, and the record of the phantom device is deleted; the configuration file corresponding to the phantom device is modified, and the modified The configuration file, updating the phantom device;

If the IP of the real device does not conflict with the IP of the phantom device, determining whether the MAC address of the real device conflicts with the MAC address of the phantom device;

If the MAC address of the real device conflicts with the MAC address of the phantom device, reselecting a MAC address for the phantom device; updating the MAC address of the phantom device according to the reselected MAC address;

If the MAC address of the real device does not conflict with the MAC address of the phantom device, the new device that is newly online is continuously monitored.
The method of claim 1 further comprising:

Determining whether the phantom device has reached a refresh cycle;

If yes, re-execute the steps of establishing a phantom device;

If not, continue to use the phantom device.
An anti-network attack method, comprising:

Real-time monitoring of communication information of a phantom device in a local area network; wherein the phantom device is established by the method of any one of claims 1-7;

Determining whether there are other devices communicating with the phantom device;

If not, continue to monitor the communication information of the phantom device;

If so, mark the other device as a suspicious device;

Blocking communication between the suspicious device and the phantom device and the real device in the local area network, and transmitting the information of the suspicious device to a network administrator.
The method of claim 8 further comprising: continuously monitoring the suspicious device while blocking communication between the suspect device and the phantom device and the real device in the local area network.
The method according to claim 8, further comprising: collecting the risk information of the phantom device in real time after the phantom device is established, and transmitting the risk information to the user.
A computer readable storage medium having stored thereon a computer program, characterized in that the program is executed by a processor to implement the method of any of claims 1-7.
A computer apparatus comprising: a memory, a processor, and a computer program stored on the memory and operative on the processor, wherein the processor executes the program to implement any of claims 1-7 The method described.