WO2019179375A1 - 一种防御网络攻击的方法及装置 - Google Patents

一种防御网络攻击的方法及装置 Download PDF

Info

Publication number
WO2019179375A1
WO2019179375A1 PCT/CN2019/078391 CN2019078391W WO2019179375A1 WO 2019179375 A1 WO2019179375 A1 WO 2019179375A1 CN 2019078391 W CN2019078391 W CN 2019078391W WO 2019179375 A1 WO2019179375 A1 WO 2019179375A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
packet
address
destination
fake
Prior art date
Application number
PCT/CN2019/078391
Other languages
English (en)
French (fr)
Inventor
王雨晨
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19770587.4A priority Critical patent/EP3761589A4/en
Publication of WO2019179375A1 publication Critical patent/WO2019179375A1/zh
Priority to US17/026,202 priority patent/US11570212B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/10—Active monitoring, e.g. heartbeat, ping or trace-route
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/20—Hop count for routing purposes, e.g. TTL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the present application relates to the field of network technologies, and in particular, to a method and apparatus for defending against network attacks.
  • honeypots are a computer system that runs on the Internet.
  • honeynet refers to the overall network architecture that traps these attacks.
  • a honeynet system usually contains one or more honeypots. The honeynet system is used to collect the attack information of the intruder, so how to induce the attacker to attack the honeynet is an important part of the honeynet system.
  • the present invention provides a method and device for defending against network attacks, which solves the problem of high network defense cost in the prior art.
  • the present application provides a method for defending against a network attack, the method comprising: receiving, by a network security device, a first packet sent by an external device, and using a destination network protocol (internet protocol, IP) of the first packet
  • IP internet protocol
  • the address matches the configuration information of the fake network. If the IP address of a node in the configuration information of the fake network has the same subnet prefix as the destination IP address, the network security device processes the first packet according to a false network policy, if the false If the IP address of a node does not have the same subnet prefix as the destination IP address, the network security device processes the first packet based on the firewall policy.
  • the network security device is deployed between the protected network and the external network where the external device is located, where the network security device stores configuration information of the fake network, where the configuration information includes each node of the fake network.
  • Network protocol IP address, each of the fake network policies includes a matching condition, and an action corresponding to the matching condition, the action comprising constructing and transmitting a response message, or prohibiting the response to the first message, Or redirecting the first message to the honeypot device.
  • the network security device displays the fake network topology to the attacker by matching the received packet with the configuration information of the fake network and responding to the received message or not responding based on the fake network policy.
  • the gateway device uses the existing packet matching technology to display a false network topology to the attacker, thereby reducing the probability of the first attack of the real system, and this The method can make the attacker pay more data for data analysis to judge the real node and the fake node, thereby achieving the purpose of interference and misleading the attacker's attack activity at a low cost.
  • the network security device processes the first packet based on a fake network policy, where the network security device determines the matching information of the first packet, and the first packet is The matching information is matched with the matching condition included in the at least one of the fake network policies, and the fake network policy that matches the first packet is selected, where the matching information of the first packet meets the selected A matching condition in the fake network policy, and then performing the selected action in the fake network policy.
  • the matching information includes at least one of the following: a protocol type of the first packet, a destination IP address of the first packet, and a destination port number of the first packet.
  • the network security device may use the existing packet matching technology to match the matching information of the first packet with the matching condition included in the at least one fake network policy to select a fake network policy, and perform the received packet.
  • the response or non-response processing makes the attacker mistakenly believe that each node in the fake network exists in the protected network, thereby reducing the probability of the first attack of the real system, thereby achieving interference and misleading the attacker at a lower cost.
  • the purpose of the attack activity is used to use the existing packet matching technology to match the matching information of the first packet with the matching condition included in the at least one fake network policy to select a fake network policy, and perform the received packet.
  • the matching condition in the selected false network policy is: the protocol type is an internet control message protocol (ICMP), and the destination IP address is the first in the fake network.
  • the IP address of the node, the action in the selected fake network policy is: constructing and sending a response message, or redirecting the first message to the honeypot device, wherein the response message is used to indicate the location
  • the destination IP address is reachable.
  • An ICMP packet is a packet used to detect whether an IP address is reachable.
  • the network security device uses the first packet as an ICMP packet and the destination IP address of the first packet is in a fake network.
  • the existing packet matching technology is used to respond to the external device to indicate that the destination IP address is reachable, so that the attacker mistakes the first one in the protected network.
  • a node so that the interference can be achieved at a lower cost, the attacker's attack activity is misdirected, or the first packet is redirected to the honeypot device, so that the first packet can be analyzed and detected by the honeypot device, thereby Network security defenses can be achieved by deploying fewer honeypot devices, which can reduce the cost of network security defenses.
  • the configuration information further includes a topology relationship of each node of the fake network, where the response packet carries a lifetime, and the lifetime is determined by the network security device based on the topology relationship. Deterministic, and the time to live indicates the number of routing nodes that the message passes through during the process of sending to the first node.
  • the network security device can display the false network topology to the attacker by telling the attacker the number of times the packet is forwarded before reaching the first node, so that the attacker can be interfered with and the attacker can be misleading at a low cost. The purpose of the attack activity.
  • the matching condition in the selected false network policy is: the protocol type is ICMP, the destination IP address is not the IP address of any node in the fake network, and the selected fake network is selected.
  • the action in the policy is: constructing and sending a response message, or redirecting the first message to the honeypot device, wherein the response message is used to indicate that the destination IP address is unreachable, and the destination IP address The IP address of the gateway device corresponding to the subnet prefix of the address is reachable.
  • the network security device uses the existing packet matching technology to the outside when the first packet is an ICMP packet and the destination IP address of the first packet is not the IP address of any node in the fake network.
  • the device responds to the packet that the destination IP address is unreachable, and the IP address of the gateway device corresponding to the subnet prefix of the destination IP address is reachable, so that the attacker mistakenly believes that the destination IP does not exist in the protected network.
  • the first message can be analyzed and detected by the honeypot device, thereby implementing network security defense by deploying fewer honeypot devices, thereby reducing the cost of network security defense.
  • the configuration information further includes a topology relationship of each node of the fake network, where the response packet carries a lifetime, and the lifetime is determined by the network security device based on the topology relationship.
  • the timeout period is determined, and the time-to-live indicates the number of times the packet is forwarded before the gateway device corresponding to the subnet prefix of the destination IP address.
  • the network security device displays the number of routing nodes that the attacker passes in the process of the gateway device corresponding to the subnet prefix sent to the destination IP address, so as to display the false network topology to the attacker. Therefore, the purpose of disturbing and misleading the attacker's attack activity can be realized at a low cost.
  • the matching condition in the selected false network policy is: the protocol type is a transmission control protocol (TCP), and the destination port is the first port in the fake network, The destination port is determined according to the destination IP address and the destination port number, and the action in the selected fake network policy is: constructing and sending a response packet, or redirecting the first packet to the honeypot device, where The response message is used to indicate that the destination port is open.
  • TCP packet is a packet used to detect whether a TCP port exists in the destination port of the network device, that is, whether the port is in an open state.
  • the network security device uses the first packet as a TCP packet and a destination port.
  • the existing packet matching technology is used to respond to the external device to indicate that the destination port is in an open state, so that the attacker mistakes the protected network for the purpose.
  • An open TCP service exists on the port corresponding to the destination port number on the node corresponding to the IP address, so that the attacker can be interfered with and the attacker is misdirected at a lower cost, or the first packet is redirected to the honey.
  • the can equipment enables the first message to be analyzed and detected by the honeypot device, thereby improving the security of the protected network, and implementing network security defense by deploying fewer honeypot devices, thereby reducing the cost of network security defense. .
  • the matching condition in the selected false network policy is: the protocol type is TCP, the destination port is not the first port in the fake network, and the selected false network policy is selected.
  • the action is: constructing and sending a response message, or redirecting the first message to the honeypot device, wherein the response message is used to indicate that the destination port is not open.
  • the network security device responds to the external device by using the existing packet matching technology to indicate the destination port when the first packet is a TCP packet and the destination port is the first port in the fake network.
  • the packet is in an unopened state, so that the attacker mistakes the port corresponding to the destination port number on the node corresponding to the destination IP address in the protected network, and there is no open TCP service, thereby lowering the cost.
  • the purpose of the attacker is to interfere with the attacker's attack activity, or to redirect the first packet to the honeypot device, so that the first packet can be analyzed and detected by the honeypot device, thereby improving the security of the protected network.
  • network security defense can be achieved by deploying fewer honeypot devices, which can reduce the cost of network security defense.
  • the first port may be configured according to actual requirements.
  • the first port may be a port of any one of the nodes of the fake network that is included in the first set, and the first set includes at least one port number; or
  • the first port may also be a port included in the second set of any port number on the second node in the fake network, the second set includes at least one port number, and the like.
  • the matching condition in the selected fake network policy is: the protocol type is TCP, and the destination port number is The port number in a set, the selected action in the fake network policy is: constructing and sending a response message, or redirecting the first message to a honeypot device, wherein the response message is used Indicates that the port corresponding to the destination port number on the destination device is in an open state, and the IP address of the destination device is the same as the destination IP address.
  • the matching condition in the selected fake network policy is: the protocol type is TCP, the destination port number is not the port number in the first set, and the selected action in the fake network policy is: constructing and sending a response Transmitting, or redirecting the first packet to the honeypot device, where the response packet is used to indicate that the port corresponding to the destination port number on the destination device is not open, and the IP address of the destination device The address is the same as the destination IP address.
  • the matching condition in the fake network policy is: the protocol type is TCP, and the destination IP address is The IP address and the destination port number of the second node in the fake network are the port numbers included in the second set, and the selected action in the fake network policy is: constructing and sending a response message, or The first packet is redirected to the honeypot device, wherein the response packet is used to indicate that the port corresponding to the destination port number in the second node is in an open state.
  • the matching condition in the selected fake network policy is: the protocol type is TCP, and the destination IP address is not the IP address of the second node in the fake network, and/or the destination port number is not included in the second set.
  • the action of the selected port number in the fake network policy is: constructing and sending a response message, or redirecting the first message to a honeypot device, wherein the response message is used to indicate a destination IP address.
  • the port corresponding to the destination port number on the node corresponding to the address is not open.
  • the matching condition in the selected false network policy is: a protocol type is a user datagram protocol (UDP), and a destination port is a second port in the fake network.
  • the destination port is determined according to the destination IP address and the destination port number, and the action in the selected fake network policy is: prohibiting the response to the first packet, or redirecting the first packet to the honey Tank equipment.
  • a UDP packet is a packet used to detect whether a UDP service exists on the destination port of the network device, that is, whether the port is in an open state.
  • the network security device uses the first packet as a UDP packet and the destination.
  • the existing packet matching technology does not respond to the first packet, so that the attacker mistakenly believes that the destination port in the protected network has an open UDP service, so that the port can be opened.
  • the lower cost achieves the purpose of disturbing and misleading the attacker's attack activity, or redirecting the first message to the honeypot device, so that the first message can be analyzed and detected by the honeypot device, thereby improving the protected network.
  • Security, and network security defenses can be achieved by deploying fewer honeypot devices, which can reduce the cost of network security defenses.
  • the matching condition in the selected false network policy is: the protocol type is UDP, the destination port is not the second port in the fake network, and the selected false network policy is selected.
  • the action is: constructing and sending a response message, wherein the response message is used to indicate that the destination port is unreachable, or redirect the first message to the honeypot device.
  • the network security device responds to the external device by using the existing packet matching technology when the first packet is a UDP packet and is not the second port in the fake network.
  • the port corresponding to the destination port number is unreachable, so that the attacker mistakenly believes that the port corresponding to the destination port number on the node corresponding to the destination IP address in the protected network does not have an open UDP service, so that the attacker can have a lower UDP service.
  • the cost is to achieve the purpose of the interference, misleading the attacker's attack activity, or redirecting the first packet to the honeypot device, so that the first packet can be analyzed and detected by the honeypot device, thereby improving the security of the protected network.
  • network security defense can be achieved by deploying fewer honeypot devices, which can reduce the cost of network security defense.
  • the second port may be configured according to actual requirements.
  • the second port may be any port number of all nodes of the fake network included in the third set, and the third set includes at least one port number; or
  • the second port may also be a port included in the fourth set of any port number on the third node in the fake network, the fourth set includes at least one port number, and the like.
  • the matching condition in the fake network policy is: the protocol type is UDP, and the destination port number is The port number included in the three sets, the action in the selected fake network policy is: prohibiting the first message from being replied, or redirecting the first message to the honeypot device.
  • the matching condition in the selected fake network policy is: the protocol type is UDP, the destination port number is not the port number included in the third set, and the selected action in the fake network policy is: constructing And sending a response message, where the response message is used to indicate that the port corresponding to the destination port number in the destination device is unreachable, the IP address of the destination device is the same as the destination IP address, or the first The message is redirected to the honeypot device.
  • the matching condition in the selected fake network policy is: the protocol type is UDP, and the destination is The IP address is the IP address of the fourth node in the fake network, and the destination port number is the port number included in the fourth set.
  • the action in the selected fake network policy is: prohibiting the first packet Answering or redirecting the first message to the honeypot device.
  • the matching condition in the selected fake network policy is: the protocol type is UDP, the destination IP address is not the IP address of the fourth node in the fake network, and/or the destination port number is not the fourth set.
  • the port number included in the selected virtual network policy is: constructing and transmitting a response message, or redirecting the first message to a honeypot device, wherein the response message is used to indicate The port corresponding to the destination port number on the node corresponding to the destination IP address is unreachable.
  • the network security device when constructing and sending a response message, the network security device first constructs a response message, and delays the preset time period to send the response message.
  • the attack activity can be delayed, and the warning time can be extended.
  • the matching condition in the selected false network policy is: the destination IP address is the IP address of the fifth node in the fake network, and the selected action in the fake network policy is : redirecting the first message to the honeypot device.
  • the network security device redirects the first packet to the honeypot device when the destination IP address of the first packet is the IP address of the fifth node in the fake network, so that the first packet can be honeyed.
  • the tank equipment is analyzed and detected, so that network security defense can be realized by deploying fewer honeypot devices, thereby reducing the cost of network security defense.
  • the network security device processes the first packet based on a firewall policy, first configuring a response packet in a first packet format based on a firewall policy, and sending the first packet to the external device.
  • the first packet format is a packet format corresponding to the first system type, the first system type is inconsistent with the second system type corresponding to the first internal device, and the first internal device is located in the protected network. And the IP address of the first internal device is the same as the destination IP address.
  • the format of the packets sent by different types of operating systems is different.
  • the attacker analyzes the format of the packets to determine the system type of the network device that sends the packets.
  • the different types of operating systems have different vulnerabilities and the attacker targets the network.
  • the network security device modifies the system type of the network device by modifying the packet format of the response packet in the first packet format, thereby hiding the vulnerability information of the network device, thereby enabling the attacker to judge the operation of the network device.
  • the system type gets an incorrect judgment result.
  • the network security device after receiving the second packet sent by the second internal device, changes the packet format of the second packet to the second packet format, and the second packet is The second packet of the format is forwarded.
  • the second internal device is any one of the protected networks, and the third system type corresponding to the second packet format is inconsistent with the fourth system type corresponding to the second internal device.
  • the network security device modifies the system type of the second internal device by modifying the message format of the response message in the second packet format, thereby hiding the vulnerability information of the second internal device, thereby enabling the attacker to determine When the operating system type of the second internal device is obtained, an incorrect judgment result is obtained.
  • the present application provides a network security device, the method of any one of the possible implementations of the first aspect or the first aspect.
  • the network security device comprises means for performing the method of the first aspect or any one of the possible implementations of the first aspect.
  • These units may be implemented by a program module, or may be implemented by hardware or firmware.
  • the present application provides a network security device, the device comprising a network interface, a memory, and a processor for storing program code to be executed by the processor.
  • the network interface is used to receive or send messages.
  • the processor is configured to execute the program code stored in the memory, specifically for performing the method described in any one of the first aspect or the first aspect.
  • the present application further provides a computer readable storage medium, configured to store computer software instructions for performing the functions of any of the above first aspect, the first aspect, including A program designed by any one of the methods of designing the first aspect.
  • an embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing a computer to perform the method in any of the above aspects or the first aspect of the first aspect.
  • the embodiment of the present application provides a chip system, where the chip system includes a processor for supporting a network security device to implement the functions involved in the foregoing first aspect or any possible design manner of the first aspect.
  • the chip system also includes a memory for storing the necessary program instructions and data for the network security device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • FIG. 1 is a schematic structural diagram of a network system provided by the present application.
  • FIG. 2 is a schematic topological diagram of a fake network provided by the present application.
  • FIG. 3 is a flowchart of a method for defending against network attacks according to the present application.
  • FIG. 5 is a flowchart of a method for responding to TCP port scanning according to the present application.
  • FIG. 6 is a flowchart of a method for responding to UDP port scanning according to the present application.
  • FIG. 7 is a flowchart of a method for delaying sending a response message according to the present application.
  • FIG. 8 is a flowchart of a method for defending against network attacks according to the present application.
  • FIG. 9 is a flowchart of a method for defending against network attacks according to the present application.
  • FIG. 10 is a flowchart of a method for processing an outgoing message according to the present application.
  • FIG. 11 is a schematic structural diagram of a network security device provided by the present application.
  • FIG. 12 is a schematic structural diagram of a network security device provided by the present application.
  • the present application provides a method and apparatus for defending against network attacks, which are used to solve the problem of high network defense cost.
  • the method and the device are based on the same inventive concept. Since the principles of the method and the device for solving the problem are similar, the implementation of the device and the method can be referred to each other, and the repeated description is not repeated.
  • FIG. 1 is a schematic diagram of a network system architecture applicable to the present application.
  • the system includes an external device, a network security device, and a protected network, wherein the network security device is deployed between the protected network and an external network where the external device is located.
  • the network security device can be used to filter packets sent from the external device to the protected network. For example, the legal network is allowed to pass or the attack packets are restricted, so as to protect the protected network from unauthorized users.
  • the network security device can be a single device or can be deployed on other devices, such as router devices, firewall devices, gateway devices, and so on. External devices may be, but are not limited to, computer devices, router devices, and the like.
  • the protected network includes at least one real node, which may be, but is not limited to, a router device, a computer device, or the like.
  • the attacker conducts a network attack by first performing network scanning on the protected network.
  • the network scanning includes host scanning, transmission control protocol (TCP) port scanning, and user datagram protocol (UDP).
  • Port scanning The host scans the attacker by sending an internet control message protocol (ICMP) packet to the node in the protected network to detect whether the destination IP address is reachable.
  • ICMP internet control message protocol
  • the node in the protected network is based on the protected network.
  • the actual situation responds to ICMP packets. After a large number of ICMP packets are detected, the attacker can obtain the network topology of the protected network according to the received response packets.
  • the TCP port scan process is that the attacker first sends a TCP SYN packet to the port of the node in the protected network.
  • the node If the port has an open TCP service, the node responds to the TCP SYN ACK packet, otherwise it responds to the TCP RST packet.
  • the attacker receives the response packet to determine whether the port has an open TCP service.
  • SYN is the synchronous connection sequence number flag
  • the TCP SYN message is set to 1 to request the connection.
  • ACK is the request/response status flag
  • 0 is the request
  • 1 is the response
  • the TCP SYN ACK message is set to 1 for this flag.
  • RST is the connection reset flag, and the TCP RST message sets this flag to 1.
  • the process of scanning a UDP port is that the attacker first sends a UDP packet requesting connection after a large number of ICMP packets are detected. If the port has an open UDP service, the node does not answer the UDP packet, otherwise the response is used for the UDP packet. Indicates that the port is unreachable. The attacker determines whether the port has an open UDP service by receiving the response packet. After performing the network scan, the attacker analyzes the system type of each node in the protected network according to the packet format of the response packet received during the network scanning process, and performs a node according to the vulnerability of the system type for each node. attack.
  • the traditional network security defense technology follows the three steps of discovery, analysis, and response. After the attacker attacks the destination device, the network security device collects the attack behavior and analyzes the attack behavior. After the attack signature is extracted, the attack can be performed. Effective defense. But in this way the defense lags behind the attack. Take SQL Slammer as an example. In the first 10 minutes of its attack, it infected 90% of the vulnerable servers, and the signature was extracted after 48 hours.
  • the current mainstream practice is to deploy honeypots, honeynets, etc. in the system, which refers to a computer system running on the Internet, which simulates into a vulnerable real network, host and service, etc.
  • honeynet As a bait to seduce malicious attacks, its value lies in collecting information on attacks on the network and monitoring, detecting and analyzing the information.
  • the honeynet refers to the overall network architecture that traps these attacks.
  • a honeynet system usually contains one or more honeypots.
  • the honeynet system is used to collect the attack information of the intruder, so how to induce the attacker to attack the honeynet is an important part of the honeynet system.
  • the defense method of deploying honeypots and honeynets can realize early warning and detection before the attack causes substantial damage to the real system.
  • Honeypots, honeynets and other technologies are based on data analysis. Data analysis is more difficult and costly than generating data. Attackers can easily evade and escape honeypot detection by intentionally constructing some data.
  • honeypot wants to identify the authenticity of the data, it must pay a lot of technical costs. Attackers use information obfuscation techniques to launch attacks, just as easy to sprinkle a piece of sand in a pile of white rice, and honeypots must effectively achieve network security defenses, such as screening a grain of sand from rice, visible, defense Technology costs are much higher than attack costs.
  • the embodiment of the present application introduces a technology for sending obfuscated messages on the network security device, so that the network security device responds to the constructed obfuscated message during the network scanning process of the attacker, thereby performing real information on the protected network.
  • the real information in the protected network is mixed in a large amount of false information, so that the attacker can not identify the real situation in the protected network, so either abandon the attack or identify the authenticity of the information through complex data analysis.
  • the network security device may not maintain the network connection status such as TCP, or may not analyze and process the network packet after the destination device is dropped, but trigger the attack packet, and then send the obfuscated message according to the predetermined policy.
  • the plurality referred to in the present application means two or more.
  • the firewall device performs a match on the received network packet, and performs an action based on the matching result, where the action includes blocking, forwarding, network address translation (NAT), and the like. Etc., thus performing message control to implement security protection devices.
  • the network security device maintains the basic working process of the firewall device, and saves the configuration information of the fake network, so that the network security device can construct a response packet based on the fake network policy to spoof the attacker when the attacker performs network scanning, thereby It can hide the real information of the protected network, induce the attacker to launch attacks on the fake network, and reduce the probability of the protected network being attacked.
  • the configuration information of the fake network includes the network protocol IP address of each node of the fake network, and may also include the topology relationship of each node.
  • the configuration information of the fake network may include three gateway nodes.
  • the network protocol (IP) addresses are 202.14.235.254, 202.14.236.254, and 202.14.237.254, respectively.
  • the gateway nodes with the IP address 202.14.235.254 are respectively connected to the gateway node with the IP address 202.14.236.254 and the gateway node with the IP address 202.14.237.254.
  • a gateway node with an IP address of 202.14.235.254 is connected to an end node, and the IP address of the end node is 202.14.235.1.
  • a gateway node with an IP address of 202.14.236.254 connects two end nodes, and the IP addresses of the two end nodes are 202.14.236.1 and 202.14.236.2, respectively.
  • a gateway node with an IP address of 202.14.237.254 connects two end nodes, and the IP addresses of the two end nodes are 202.14.237.1 and 202.14.237.2, respectively.
  • Each of the fake network policies includes a matching condition, and an action corresponding to the matching condition, the action including constructing and transmitting a response message, or disabling the response to the first message, or the first message Redirect to honeypot equipment and more.
  • FIG. 3 is a flowchart of a method for defending a network attack by a network security device provided by the present application.
  • the method can be used in the network system shown in Figure 1, the method comprising:
  • the network security device receives the first packet sent by the external device.
  • the network security device matches the destination IP address of the first packet with the configuration information of the fake network.
  • the network security device may first obtain the quintuple information of the first packet, where the quintuple information refers to a protocol type, a source IP address, a source port, a destination IP address, and a destination port of the network packet, and the first The destination IP address in the quintuple information of the packet matches the configuration information of the fake network.
  • step S303 is performed.
  • the network security device processes the first packet according to a fake network policy.
  • step S304 is performed.
  • the network security device processes the first packet according to a firewall policy.
  • the firewall policy is a policy used by the firewall device in the prior art to process network packets.
  • the firewall policy in the prior art may include two parts, that is, a matching part and an operation part.
  • the matching part performs quintuple information matching on the network packet, and the operation part is to report the network according to the matching result obtained by the matching part according to the preset policy.
  • the text or traffic operation, the operation can be Drop, Reject, Accept, Jump, etc.
  • the firewall policy can be implemented by the following code:
  • TCP-s 192.168.0.0/16-d 0.0.0.0/0--dport 80-j DROP//The firewall receives the source IP address with the subnet prefix of 192.168.0.0/16 and the destination port number of 80. After the TCP packet is discarded, the TCP packet is discarded.
  • TCP-s 192.168.0.0/16-d 10.10.10.1/32--dport 22-j Accept//The firewall allows the subnet prefix of the source IP address to be 192.168.0.0/16 and the destination IP address to be 10.10.10.1.
  • the TCP packet whose destination port number is 22 is passed.
  • the network security device displays the fake network by attacking the received packet with the configuration information of the fake network and responding to the received packet or not responding based on the fake network policy.
  • the topology makes the attacker mistakenly believe that each node in the fake network exists in the protected network, and cannot simply scan to distinguish which of the nodes are real nodes and which are fake nodes.
  • the gateway device uses the existing packet matching technology to display a false network topology to the attacker, thereby reducing the probability of the first attack of the real system, and this The method can make the attacker pay more data for data analysis to judge the real node and the fake node, thereby achieving the purpose of interference and misleading the attacker's attack activity at a low cost.
  • the network security device when the network security device matches the quintuple information of the first packet with the configuration information of the fake network, the network security device can be implemented by the following code, in the following code before ":” The code is a matching condition, and the code after the ":” is the action corresponding to the matching condition:
  • the network security device When the network security device processes the first packet based on the fake network policy, the network security device can be implemented as follows:
  • the network security device determines the matching information of the first packet, where the matching information includes at least one of the following: a protocol type of the first packet, and a destination IP address of the first packet. Indicates the destination port number of the first packet.
  • the network security device may determine the matching information of the first packet by analyzing the quintuple information of the first packet.
  • the network security device matches the matching information of the first packet with the matching condition included in the at least one of the fake network policies, and selects a fake network policy that matches the first packet, where The matching information of the first packet is consistent with the matching condition in the selected fake network policy.
  • the network security device performs an action in the selected fake network policy.
  • the fake network policy provided in the embodiment of the present application is specifically described by using the fake network shown in FIG. 2 as an example.
  • the network security device in the embodiment of the present application matches the configuration information of the fake network and matches the IP address of the ICMP packet sent by the attacker with the configuration information of the fake network, and is based on the fake network policy. Construct a response message to show the attacker a false network topology, as shown in Figure 4:
  • the network security device receives an ICMP packet sent by the external device.
  • the network security device matches the quintuple information of the ICMP packet with the matching condition in each of the fake network policies, and selects a false network policy based on the matching result, where the matching condition and the ICMP packet in the selected fake network policy are selected.
  • the quintuple information matches.
  • the network security device constructs a response packet based on the selected fake network policy.
  • the network security device sends the constructed response message to the external device.
  • the false network policy selected may be a fake network policy.
  • the false network policy is: the matching condition is: the protocol type is ICMP, and the destination IP address is the IP address of a node in the fake network.
  • the action in the fake network policy is: constructing and sending a response message, where The response message is used to indicate that the destination IP address is reachable.
  • the response packet may further carry a lifetime, where the lifetime is determined by the network security device based on the topology relationship of the fake network, and the time-to-live indicates that the packet is sent by the first node. The number of routing nodes that pass through the process.
  • the network security device can implement the fake network policy by using the following code: in the following code, the code before ":” is a matching condition, and the code after ":” is the Actions in a fake network policy:
  • the false network policy selected may also be a fake network policy 2.
  • the false network policy is: the matching condition is: the protocol type is ICMP, and the destination IP address is the first IP address, where the first IP address is not the IP address of any node in the fake network and the first The IP address has the same subnet prefix as the node in the fake network.
  • the action in the fake network policy is: constructing and sending a response packet, where the response packet is used to indicate that the destination IP address is unreachable.
  • the IP address of the gateway device corresponding to the subnet prefix of the destination IP address is reachable.
  • the response packet may further carry a lifetime, where the lifetime is determined by the network security device based on the topology relationship of the fake network, and the time-to-live indicates that the packet is sent by the destination IP address.
  • the number of routing nodes that the subnet prefix corresponds to during the gateway device process.
  • the network security device can implement the fake network policy 2 by using the following code in the following code: “:” The previous code is a match condition, and the code after ":" is the action in the fake network policy:
  • ⁇ ICMP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort>—> ⁇ 202.14.235.8/32> ⁇ Any_DestPort>: ⁇ NETWORK> ⁇ GW 202.14.235.254> ⁇ TTL-1>//The IP address does not exist in the protected network is 202.14. A node of 235.8/32, and a gateway with an IP address of 202.14.235.254 exists. And the TTL of the response needs to be decremented by 1.
  • the network security device can be implemented by the following code: in the following code, the code before ":” is a matching condition, and the code after ":” is the action corresponding to the matching condition:
  • the network security device can respond to the host unreachable message with the ICMP packet with the subnet prefix of 202.14.230.0/24 of the destination IP address.
  • 202.14.230.0/24 For example, in the case of the fake network or the protected network, 202.14.230.0/24. It can be implemented by the following code. In the following code, the code before “:” is the matching condition, and the code after ":” is the action corresponding to the matching condition:
  • the first packet is an ICMP Request (Echo Request) packet whose destination IP address is 202.14.237.2.
  • the network security device determines that the ICMP Echo Request packet matches the ⁇ ICMP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort>-> ⁇ 202.14.237.2/32> ⁇ Any_DestPort>", according to the fake network policy one, " ⁇ ICMP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort>-> ⁇ 202.14.237.2/32> ⁇ Any_DestPort>: ⁇ NODE> ⁇ TTL-2> Construct an ICMP echo (Echo Reply) packet with the source IP address of 202.14.237.2 and TTL minus 2, and send it to the external device, so that the external device considers 202.14.237.2 to exist in the protected network of the network security device, and The external device is determined to position 202.14.237.2 in the protected network, that is, in the process of transmitting the first packet in 202.14.237.2, two routing nodes need to pass.
  • the first packet is an ICMP Echo Request packet whose destination IP address is 202.14.235.8.
  • the network node does not exist in the network, and the gateway node corresponding to the subnet prefix exists in the protected network.
  • the IP address of the gateway node is 202.14.235.254, and the first packet needs to go through the process of sending to 202.14.235.254. 2 routing nodes.
  • the first packet is an ICMP Echo Request packet whose IP address is 202.14.239.11/32.
  • the network security device determines that the destination IP address of the ICMP Echo Request packet is neither in the fake network nor in the protected network. Then construct a host unreachable message.
  • the network security device sends the response packet to the attacker based on the configuration information of the fake network and the fake network policy, so that the attacker can obtain an unrealistic network topology map, which can interfere with and mislead the attacker.
  • the behavior in turn, can reduce the probability of being attacked by the protected network, and can also cause the attacker to perform data analysis to distinguish the authenticity of the information, thereby increasing the attack cost of the attacker.
  • the network security device in the embodiment of the present application matches the matching condition in the fake network policy after receiving the TCP packet sent by the attacker, and constructs the false network policy based on the matching success.
  • the SYN ACK packet or the RST packet is used to display the TCP service that does not exist in the fake network to the attacker, as shown in Figure 5.
  • the network security device receives a TCP packet sent by the external device.
  • the network security device matches the quintuple information of the TCP packet with the matching condition in each of the fake network policies, and selects a false network policy based on the matching result, where the matching condition and the TCP packet in the selected fake network policy are selected.
  • the quintuple information matches.
  • the network security device constructs a response packet based on the selected fake network policy.
  • the network security device sends the constructed response message to the external device.
  • the false network policy selected may be a fake network policy III.
  • the false network policy is: the matching condition is: the protocol type is TCP, and the destination port is the first port in the fake network.
  • the destination port is determined according to the destination IP address and the destination port, and the corresponding action is: constructing and sending a response.
  • the chosen fake network policy can also be a fake network policy four.
  • the false network policy is: the matching condition is: the protocol type is TCP, and the destination port is the second port in the fake network.
  • the action in the fake network policy is: constructing and sending a response message, where the response message is used. Indicates that the destination port is not open.
  • the first port may be any port in the fake network.
  • the first port may be a port with a port number of 1 to 1024 on all nodes with a subnet prefix of 202.14.236.0/24 of the IP address in the fake network.
  • the first port may be a port with a port number of 1 to 1024 on a node with an IP address of 202.14.236.1 in the fake network, and so on, which is not specifically limited herein.
  • the second port may be any port in the fake network that is different from the first port.
  • the first port is a port with a port number of 1 to 1024 on all nodes with a subnet prefix of the IP address in the fake network of 202.14.236.0/24
  • the second port is a subnet of the destination IP address in the fake network.
  • Any port of the node with the prefix 202.14.235.0/24, or any port with the subnet prefix of the destination IP address of 202.14.237.0/24, or the subnet prefix of the destination IP address is 202.14.236.0/24
  • the port number is 1025 to 65535 on all nodes.
  • the false network policy 3 can be: the matching condition is: the protocol type is TCP, the subnet prefix of the destination IP address is 202.14.236.0/24, and the destination port number is included in ⁇ 1, 2, 3, 1023, 1024 ⁇ , the action in the fake network policy is: constructing and sending a response message, where the response message is used to indicate that the port corresponding to the destination port number in the destination device is The open state, and the IP address of the destination device is the same as the destination IP address.
  • the network security device can implement the fake network policy 3 by the following code: in the following code, the code before ":” is a matching condition, and the code after ":” is an action in the fake network policy:
  • the false network policy 4 can be: the matching condition is: the protocol type is TCP, and the subnet prefix of the destination IP address is 202.14.235.0/24, or the matching condition is: the protocol type is TCP, and the subnet prefix of the destination IP address 202.14.237.0/24, or the matching condition is: the protocol type is TCP, and the subnet prefix of the destination IP address is 202.14.236.0/24, and the destination port number is included in ⁇ 1025, 1026, 1027...65534, 65535 ⁇
  • the action in the fake network policy is: constructing and sending a response message, where the response message is used to indicate that the port corresponding to the destination port number in the destination device is not open, and the IP address of the destination device The address is the same as the destination IP address.
  • the network security device can implement the fake network policy four by the following code. In the following code, the code before ":" is a matching condition, and the code after ":” is an action in the fake network policy:
  • ⁇ TCP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort> ⁇ TCP_SYN 1>—> ⁇ 202.14.235.0/24> ⁇ Any_DestPort>: ⁇ TCP> ⁇ TCP_RST>//The subnet prefix of the IP address is 202.14.235.0/24 The port does not have an open TCP service;
  • ⁇ TCP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort> ⁇ TCP_SYN 1>—> ⁇ 202.14.237.0/24> ⁇ Any_DestPort>: ⁇ TCP> ⁇ TCP_RST>//The subnet prefix of the IP address is 202.14.237.0/24 The port does not have an open TCP service;
  • the port with the port number of 1 to 1024 in the node corresponding to the IP address of the host with the subnet prefix of 202.14.236.0/24 in the fake network is open. There are no open TCP services on other ports in the network.
  • the first port is a port with a port number of 1 to 1024 in the node with the IP address of 202.14.236.1 in the fake network
  • the second port is the subnet prefix of the destination IP address in the fake network is 202.14.235.0/24.
  • the fake network policy 3 can be: the matching condition is: the protocol type is TCP, the destination IP address is 202.14.236.1, and the destination port number is included.
  • the action in the fake network policy is: constructing and transmitting a response message, wherein the response message is used to indicate the destination on the node corresponding to the destination IP address.
  • the port corresponding to the port number is open.
  • the network security device can implement the fake network policy by the following code. In the following code, the code before ":” is the matching condition, and the code after ":” is the action in the fake network policy:
  • the false network policy 4 can be: the matching condition is: the protocol type is TCP, the subnet prefix of the destination IP address is 202.14.235.0/24, or the matching condition is: the protocol type is TCP, and the subnet prefix of the destination IP address is 202.14. .237.0/24, or, the matching condition is: the protocol type is TCP, the destination IP address is 202.14.236.2/32, or the matching condition is: the protocol type is TCP, the destination IP address is 202.14.236.1/32, the destination port number In the ⁇ 1025, 1026, 1027, ...
  • the action in the fake network policy is: constructing and sending a response message, wherein the response message is used to indicate the node corresponding to the destination IP address.
  • the port corresponding to the destination port number is not open.
  • the network security device can implement the fake network policy by the following code. In the following code, the code before ":” is a matching condition, and the code after ":” is an action in the fake network policy:
  • ⁇ TCP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort> ⁇ TCP_SYN 1>—> ⁇ 202.14.235.0/24> ⁇ Any_DestPort>: ⁇ TCP> ⁇ TCP_RST>//The subnet prefix of the IP address is 202.14.235.0/24 The port does not have an open TCP service;
  • ⁇ TCP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort> ⁇ TCP_SYN 1>—> ⁇ 202.14.237.0/24> ⁇ Any_DestPort>: ⁇ TCP> ⁇ TCP_RST>//The subnet prefix of the IP address is 202.14.237.0/24 The port does not have an open TCP service;
  • ⁇ TCP_Potocal> ⁇ Any_SourceIP> ⁇ Any_SourcePort> ⁇ TCP_SYN 1>—> ⁇ 202.14.236.2/32> ⁇ Any_DestPort>: ⁇ TCP_RST>//The port in the node with the IP address 202.14.236.2 does not have an open TCP service;
  • the first packet is a destination IP address of 202.14.236.1 and the destination port number is 566.
  • the port with the port number of 1 to 1024 in the node with the IP address of 202.14.236.1 in the fake network has an open TCP service, and other ports in the fake network do not exist. Open TCP service.
  • the network security device in the embodiment of the present application matches the matching condition in the fake network policy after receiving the UDP packet sent by the attacker, and is based on the successful false network policy. Answering or constructing an ICMP packet indicating that the port is unreachable to display the UDP service that does not exist in the fake network to the attacker, as shown in Figure 6.
  • the network security device receives a UDP packet sent by the external device.
  • the network security device matches the quintuple information of the UDP packet with the matching condition in each of the fake network policies, and selects a false network policy according to the matching result, where the matching condition and the TCP packet in the selected fake network policy are selected.
  • the quintuple information matches.
  • the network security device constructs a response message or does not answer based on the selected fake network policy.
  • the network security device sends the constructed response message to the external device.
  • the false network policy selected may be a fake network policy five.
  • the false network policy is as follows: the matching condition is: the protocol type is UDP, and the destination port is the third port in the fake network, and the corresponding action is: no response is received to the UDP packet.
  • the false network policy selected can also be a fake network policy.
  • the false network policy is as follows: the matching condition is: the protocol type is UDP, and the destination port is the fourth port in the fake network, and the corresponding action is: constructing and sending a response packet, where the response packet is used to indicate the destination port. Unreachable.
  • the third port may be any port in the fake network.
  • the third port may be a port with a port number of 53 in the node with an IP address of 202.14.237.1 in the fake network, and the third port may also be The subnet prefix of the IP address in the fake network is the port number of the port number 1 to 1024 on all the nodes of the port 202.14.236.0/24, and so on, and the embodiment of the present application is not specifically limited herein.
  • the fourth port may be any port in the fake network that is different from the third port.
  • the third port is a port with a port number of 53 in the node with an IP address of 202.14.237.1 in the fake network
  • the fourth port is a node with a subnet prefix of 202.14.235.0/24 of the destination IP address in the fake network.
  • the port or the port on the node with the destination IP address of 202.14.237.2/32 is used as an example.
  • the false network policy 5 can be: the matching condition is: the protocol type is UDP, the destination IP address is 202.14.237.1, and the destination port number is 53, the action in the fake network policy is: no answer.
  • the network security device can implement the fake network policy five by the following code: in the following code, the code before ":” is a matching condition, and the code after ":” is an action in the fake network policy:
  • the false network policy 6 can be: the matching condition is: the protocol type is UDP, and the subnet prefix of the destination IP address is 202.14.235.0/24, or the matching condition is that the protocol type is UDP, and the subnet prefix of the destination IP address is 202.14.236.0/24, or, the matching condition is that the protocol type is UDP, the destination IP address is 202.14.237.1/32, and the destination port number is included in ⁇ 1, 2, 3...51, 52, 54, 55...65534, In 65535 ⁇ , or the matching condition is that the protocol type is UDP and the destination IP address is 202.14.237.2/32.
  • the action in the fake network policy is: constructing and sending a response message, where the response message is used to indicate The port corresponding to the destination port number in the three nodes is not open.
  • the network security device can implement the fake network policy by the following code. In the following code, the code before ":” is a matching condition, and the code after ":” is an action in the fake network policy:
  • the UDP packet whose destination port number is 53 is taken as an example.
  • the UDP packet with the destination port number being 2566 is used as an example.
  • the port with the port number of 1 to 1024 in the node with the IP address of 202.14.236.1 on the fake network has an open UDP service.
  • the other ports in the fake network do not exist. service.
  • the third port is a port with a port number of 1 to 1024 on all nodes with a subnet prefix of the IP address in the fake network of 202.14.236.0/24
  • the fourth port is a subnet prefix of the destination IP address in the fake network.
  • the port number is 1025 to 65535.
  • the fake network policy 5 can be: the matching condition is: the protocol type is UDP, the subnet prefix of the destination IP address is 202.14.236.0/24, and the destination port number is included in ⁇ 1. In 2, 3...1023, 1024 ⁇ , the action in the fake network policy is: no response.
  • the network security device can implement the fake network policy by the following code. In the following code, the code before ":” is a matching condition, and the code after ":" is an action in the fake network policy:
  • the false network policy 6 can be: the matching condition is: the protocol type is UDP, and the subnet prefix of the destination IP address is 202.14.235.0/24, or the matching condition is that the protocol type is UDP, and the subnet prefix of the destination IP address is 202.14.237.0/24, or the matching condition is that the protocol type is UDP, the subnet prefix of the destination IP address is 202.14.236.0/24, and the destination port number is included in ⁇ 1025, 1025...65534, 65535 ⁇ , the fake network
  • the action in the policy is: constructing and sending a response message, where the response message is used to indicate that the port corresponding to the destination port number in the destination device is not open, and the IP address of the destination device and the destination are The IP address is the same.
  • the network security device can implement the fake network policy by the following code. In the following code, the code before ":" is a matching condition, and the code after ":” is an action in the fake network policy:
  • the UDP packet with the destination port number being 566 is taken as an example.
  • the UDP packet with the destination port number being 2566 is used as an example.
  • the port that has a subnet prefix of 202.14.236.0/24 in the fake network is considered to have an open UDP service on the port with the port number of 1 to 1024. There are no open UDP services on other ports in the network.
  • the network security device may delay the preset time length and then send the response message after constructing the response message based on the fake network policy, as shown in FIG. 7, thereby delaying the establishment of each session. time.
  • the attacker needs to maintain the state of waiting for the callback, which can consume a large amount of resources of the attacker, thereby slowing down the speed of the attacker's network scanning.
  • the network device responds to a TCP packet for 2 seconds, and the attacker completes the TCP port scanning of 254 network devices for about 8 minutes.
  • the network security device responds in the configuration. After the packet is delayed for a preset period of time, the response packet is sent. If the preset duration is 20 seconds, it takes about 85 minutes for the attacker to complete the TCP port scan of 254 network devices, which can greatly reduce the attacker. Scan speed.
  • the network security device can specify the delay time in the fake network policy.
  • the port with the port number of 1 to 1024 on all nodes with the subnet prefix of the IP address in the fake network is 202.14.236.0/24.
  • the preset time is 40 seconds.
  • the specified delay time can be achieved by the following code. In the following code, the code before the ":" is the matching condition, in the ":” The code following is the action in the fake network policy:
  • the attacker By delaying the sending of response packets, the attacker sends a TCP port scan to the port of the node in the fake network.
  • the TCP packets sent by the attacker are acknowledged after a delay of 40 seconds. During this period, the attacker must maintain the response. Waiting for the status of the TCP packet response, which can greatly consume the attacker's resources, forcing the attacker to reduce the speed of scanning and attack, and slow down the attack.
  • the packets sent by the network security device to the fake network regardless of whether the behavior contains known attack features, are highly suspected. Therefore, the network security device can also redirect the packets sent to the fake network to the honeypot. Equipment for analysis.
  • the network security device redirects the packet sent to the fake network to the honeypot device, it can redirect all the packets sent to the fake network to the honeypot device, or redirect some packets sent to the fake network to the honeynet device.
  • the embodiment of the present application is not specifically limited herein.
  • the network security device redirects the TCP packets sent to the fake network to the honeypot as an example, and specifically describes the process of processing the first packet by the network security device based on the fake network policy, as shown in FIG.
  • the network security device receives the first packet.
  • step S802 is performed.
  • the network security device constructs a response packet based on the fake network policy 1 or the fake network policy 2.
  • step S803 is performed.
  • the network security device redirects the first packet to the honeypot device.
  • the network security device can be implemented by the following code. In the following code, the code before “:” is the matching condition, and the code after the ":” is the corresponding action:
  • step S804 is performed.
  • the network security device constructs a response message based on the fake network policy 5 or the fake network policy 6.
  • the network security device redirects all the packets sent to the fake network to the honeypot as an example, and specifically describes the process of processing the first packet by the network security device based on the fake network policy, as shown in FIG.
  • the network security device receives the first packet.
  • the network security device redirects the first packet to the honeypot device.
  • the network security device can be implemented by the following code.
  • the code before “:” is the matching condition
  • the code after the ":” is the corresponding action:
  • the network forwarding device can map the port of each node in the fake network to the port of the honeypot device, and then the network security device receives the first packet.
  • the TCP packet is forwarded to the honeypot device when the TCP packet is sent to the fake network.
  • the network security device can also redirect the first packet to the honeypot device through the tunneling technology, that is, a network tunnel is established between the network security device and the honeypot device, and the network security device directly encapsulates the first packet in the network.
  • the tunnel is forwarded to the honeypot device.
  • the honeypot device can obtain the first packet through the tunnel and process it. After processing, the network packet that needs to be returned can be returned to the network security device through the tunnel, and then sent to the external device by the network security device or Protected network.
  • the network security device may also redirect the first packet to the honeypot device by other technologies, and the embodiment of the present application is not specifically limited herein.
  • the security of the protected network can be improved by redirecting the more skeptical messages to the honeypot device for analysis.
  • the embodiment of the present application submits a message with a high degree of suspicion to the honeypot device for analysis, and can liberate the honeypot and other devices from processing a large amount of normal traffic. It improves the efficiency of the use of equipment such as honeypots, thereby reducing the cost of network security defense.
  • IP packet field This field includes the IP ID identifier, and the IP IDs in the IP packets sent by different types of systems are different.
  • TCP packet field This field includes the initial sequence number (ISN), the initial window size of the TCP, the type in the TCP options, the value, and their order in the packet, and sent by different types of systems.
  • the initial sequence number (ISN) in the TCP message, the initial window size of the TCP, the type in the TCP options, the values, and their order in the packet are different.
  • UDP packet field When the network device receives a UDP service request message for a non-existing UDP service port, it responds with an ICMP error control message, that is, a port unreachable message, which is "ICMP destination unreachable".
  • ICMP error control message that is, a port unreachable message, which is "ICMP destination unreachable.
  • One method is that, according to the TCP transmission control protocol RFC793, the node does not respond to the message after receiving the TCP FIN message, but the system type is MS Windows, BSDI, CISCO, HP/UX, MVS, and IRIX. After receiving the TCP FIN message, the node sends back a RESET response message. Therefore, an attacker can use this feature to identify the type of system.
  • the other method is that the system type is a new version of Solaris, IRIX, FreeBSD, Digital UNIX, Cray, etc.
  • the initial sequence number (ISN) selected by the node in response to a TCP SYN message is a random increment.
  • the ISN whose system type is the old version of UNIX when responding to a TCP SYN packet is 64K, and the system type is Linux 2.0.x, OpenVMS, and the new AIX node responds to a TCP SYN packet. True random number.
  • the ISN selected by the node of the system type Windows in response to a TCP SYN message is determined by a time correlation model, and the ISN is added with a fixed number and the like every time. Therefore, an attacker can identify the system type based on the ISN selected when the node responds to a TCP connection request.
  • the TCP window size of the TCP packet sent by the node of the system type AIX is 0x3F25
  • the TCP window size of the TCP packet sent by the node of the system type Windows2000, OpenBSD, and FreeBSD is 0x402E. Therefore, an attacker can use this feature to identify the type of system.
  • Another method is that when a closed TCP port on a node of most system types receives a packet with the FIN
  • the system system for Windows nodes and some network printer devices will increase the ACK by one. If an open TCP port on a Windows node receives a message with the FIN
  • an attacker can also identify the system type based on ICMP error messages, ICMP message references, ICMP error message response integrity, service type, IP fragment reassembly, TCP options, SYN Flood limits, and so on.
  • the system type may also be identified according to the total length of the IP, the IP ID field, the IP header checksum, the UDP header checksum, the priority field, the DF bit response, the IP ID field, the IP TTL field, the TOS field, and the like.
  • the network security device can also adjust the format of the outgoing message sent to the external device, so that the external device can determine the wrong system type according to the feature field of the received message that can expose the system type.
  • the outgoing packet may be a response packet of the first packet that is configured by the network security device based on the firewall policy, or the outgoing packet may be a packet forwarded by the internal device in the protected network through the network security device.
  • the network security device may adjust the packet format according to the masquerading policy according to the spoofing policy, but does not modify the payload of the response packet.
  • the spoofing policy includes a matching condition and an action corresponding to the matching condition, that is, the packet format of the outgoing message is adjusted according to the masquerading template, wherein the masquerading template defines at least one protocol field that needs to be rewritten, and after the protocol field is rewritten, the spoofing policy is The payload of the text has no effect, but can expose the message to an unrealistic system type. The attacker cannot obtain the wrong conclusion when judging the system type of the internal device according to the received message, so that the internal device vulnerability cannot be obtained.
  • the protocol field to be rewritten may be an ICMP error message, an ICMP message reference, an ICMP error message response integrity, a service type, an IP fragment reassembly, a TCP option, a SYN Flood limit, etc., which may expose a feature field of the system type.
  • the matching condition in the masquerading policy may be set as required.
  • the matching condition may be that the source IP address is any IP address in the protected network, and the source port number is any port number; or, the matching condition may also be The protocol type is TCP, the source IP address is any IP address in the protected network, and the source port number is 80. Alternatively, the matching condition may be other.
  • the embodiment of the present application does not specifically limit the content.
  • S1001 The network security device matches the quintuple information of the outgoing message with the matching condition in the masquerading policy.
  • step S1002 is performed.
  • the network security device adjusts the format of the outgoing packet according to the spoofing template, and forwards the adjusted outgoing packet.
  • step S1003 is performed.
  • S1003 The network security device forwards the outgoing packet.
  • the matching condition in the masquerading policy is that the source port number is 80 and the protocol type is TCP.
  • the network security device can implement the masquerading policy by the following code.
  • the code before the ":" is the matching condition, in the ":
  • the code following is the action in the camouflage strategy:
  • the spoofing template can be a packet format corresponding to a certain system type.
  • the attacker or the ordinary user receives the network packet after masquerading the system type. Since the packet payload is unchanged, the normal user is not affected, but the attacker cannot identify the system type of the internal device in the protected network by receiving the protocol field of the network packet.
  • the present application further provides a network security device.
  • the network security device is deployed between a protected network and an external network where the external device is located.
  • the network security device includes configuration information of a fake network, where the configuration information includes a network protocol IP address of each node of the fake network, and the network security device includes a receiving unit 1101, a matching unit 1102, and a first processing unit 1103. And a second processing unit 1104.
  • the receiving unit 1101 is configured to receive a first packet sent by an external device.
  • the matching unit 1102 is configured to match the destination IP address of the first packet received by the receiving unit 1101 with the configuration information of the fake network.
  • the first processing unit 1103 is configured to process the first packet according to a fake network policy when an IP address of a node in the configuration information of the fake network has the same subnet prefix as the destination IP address.
  • the fake network policy includes a matching condition, and an action corresponding to the matching condition, where the action includes constructing and transmitting a response message, or prohibiting the response to the first message, or the first report The text is redirected to the honeypot device.
  • the second processing unit 1104 is configured to process the first packet according to a firewall policy when an IP address of a node does not have the same subnet prefix as the destination IP address in the configuration information of the fake network.
  • the first processing unit 1103 is specifically configured to determine the matching information of the first packet, and match the matching information of the first packet with the at least one of the fake network policies.
  • the condition is matched, the fake network policy matching the first packet is selected, and the selected action in the fake network policy is executed.
  • the matching information includes at least one of the following: a protocol type of the first packet, a destination IP address of the first packet, and a destination port number of the first packet.
  • the matching information of the first packet is consistent with the matching condition in the selected fake network policy;
  • the matching condition in the selected fake network policy is: the protocol type is the network control message protocol ICMP, and the destination IP address is the IP address of the first node in the fake network.
  • the action in the selected fake network policy is: constructing and sending a response message, or redirecting the first message to a honeypot device, wherein the response message is used to indicate that the destination IP address is Da.
  • the configuration information may further include a topology relationship of each node of the fake network, where the response packet may further carry a lifetime, where the lifetime is determined by the network security device based on the topology relationship, and The time to live indicates the number of routing nodes that the message passes through during the process of sending to the first node.
  • the matching condition in the selected fake network policy is: the protocol type is ICMP, the destination IP address is not the IP address of any node in the fake network, and the selected location is The action in the fake network policy is: constructing and sending a response message, or redirecting the first message to a honeypot device, where the response message is used to indicate that the destination IP address is unreachable and The IP address of the gateway device corresponding to the subnet prefix of the destination IP address is reachable.
  • the configuration information may further include a topology relationship of each node of the fake network, where the response packet may further carry a lifetime, where the lifetime is determined by the network security device based on the topology relationship, and
  • the time-to-live indicates the number of routing nodes that the packet passes through during the process of the gateway device corresponding to the subnet prefix sent to the destination IP address.
  • the matching condition in the selected fake network policy is: the protocol type is the transmission control protocol TCP, the destination port number is a port number in the first set, and the first set includes At least one port number, the selected action in the fake network policy is: constructing and sending a response message, or redirecting the first message to a honeypot device, wherein the response message is used for indicating purposes
  • the port corresponding to the destination port number in the device is in an open state, and the IP address of the destination device is the same as the destination IP address.
  • the matching condition in the selected fake network policy is: the protocol type is TCP, the destination port number is not the port number in the first set, and the first set includes at least one port.
  • the action in the selected fake network policy is: constructing and sending a response message, or redirecting the first message to the honeypot device, wherein the response message is used to indicate the destination device The port corresponding to the destination port number is not open, and the IP address of the destination device is the same as the destination IP address.
  • the matching condition in the selected fake network policy is: the protocol type is user data packet protocol UDP, the destination IP address is the IP address of the second node in the fake network, The destination port number is not the port number included in the second set, and the second set includes at least one port number, and the selected action in the fake network policy is: constructing and sending a response message, or The first packet is redirected to the honeypot device, where the response packet is used to indicate that the port corresponding to the destination port number in the second node is unreachable.
  • the protocol type is user data packet protocol UDP
  • the destination IP address is the IP address of the second node in the fake network
  • the destination port number is not the port number included in the second set
  • the second set includes at least one port number
  • the selected action in the fake network policy is: constructing and sending a response message, or The first packet is redirected to the honeypot device, where the response packet is used to indicate that the port corresponding to the destination port number in the second node is unreachable.
  • the matching condition in the selected fake network policy is: the protocol type is UDP, the destination IP address is the IP address of the third node in the fake network, and the destination port number is a port number included in the second set, the second set includes at least one port number, and the selected action in the fake network policy is: prohibiting the first message from being responsive, or the first The message is redirected to the honeypot device.
  • the first processing unit 1103 may be configured to construct a response packet when the response packet is configured and sent, and send the response packet after delaying the preset duration.
  • the matching condition in the selected false network policy is: the destination IP address is the IP address of the fourth node in the fake network, and the selected false network policy is selected.
  • the action is to redirect the first message to the honeypot device.
  • the second processing unit 1104 is configured to configure, according to a firewall policy, a response packet in a first packet format, and send the response packet in the first packet format to the external device.
  • the first packet format is a packet format corresponding to the first system type
  • the first system type is inconsistent with the second system type corresponding to the first internal device
  • the first internal device is located in the protected network.
  • the IP address of the first internal device is the same as the destination IP address.
  • the receiving unit 1101 may be further configured to receive a second packet sent by the second internal device, where the second internal device is any one of the protected networks.
  • the network security device may further include a modification unit 1105 and a forwarding unit 1106.
  • the modifying unit 1105 is configured to modify a packet format of the second packet received by the receiving unit 1101 into a second packet format, where the second packet type corresponds to a third system type and The fourth system type corresponding to the second internal device is inconsistent.
  • the forwarding unit 1106 is configured to forward the second packet in the second packet format that is modified by the modifying unit 1105.
  • each functional module in each embodiment of the present application may be integrated into one processing. In the device, it can also be physically existed alone, or two or more modules can be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the network security device can include the processor 1202.
  • the hardware of the entity corresponding to the above module may be the processor 1202.
  • the processor 1202 can be a central processing unit (English: central processing unit, CPU for short), or a digital processing module or the like.
  • the network security device can also include a communication interface 1201 through which the processor 1202 can send and receive messages.
  • the apparatus also includes a memory 1203 for storing a program executed by the processor 1202.
  • the memory 1203 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid state drive (SSD), or a volatile memory (English: volatile) Memory), such as random access memory (English: random-access memory, abbreviation: RAM).
  • Memory 1203 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the processor 1202 is configured to execute the program code stored in the memory 1203, specifically for performing the method described in the embodiment shown in FIG. 3 to FIG. 10, and details are not described herein again.
  • connection medium between the communication interface 1201, the processor 1202, and the memory 1203 is not limited in the embodiment of the present application.
  • the memory 1203, the processor 1202, and the communication interface 1201 are connected by a bus 1204 in FIG. 12, and the bus is indicated by a thick line in FIG. 12, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 12, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the invention further provides a computer readable storage medium for storing computer software instructions required to execute the above-mentioned processor, which comprises a program for executing the above-mentioned processor.
  • Embodiments of the present application provide a computer program product comprising instructions that, when run on a computer, cause the computer to perform the method of defending against network attacks as described in FIGS. 3-10.
  • the embodiment of the present application provides a chip system including a processor for supporting a network security device to implement the functions involved in the method for defending against network attacks described in FIG. 3 to FIG.
  • the chip system also includes a memory for storing the necessary program instructions and data for the network security device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Health & Medical Sciences (AREA)
  • Cardiology (AREA)
  • General Health & Medical Sciences (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请公开了一种防御网络攻击的方法及装置，用以解决网络防御成本较高的问题。该方法包括：网络安全设备接收外部设备发送的第一报文，并将第一报文的目的IP地址与虚假网络的配置信息进行匹配。若虚假网络的配置信息中的一个节点的IP地址与目的IP地址具有相同的子网前缀，则网络安全设备基于虚假网络策略处理第一报文，若虚假网络的配置信息中不存在一个节点的IP地址与目的IP地址具有相同的子网前缀，则网络安全设备基于防火墙策略处理第一报文。

Description

一种防御网络攻击的方法及装置
本申请要求于2018年3月19日提交中国国家知识产权局、申请号为201810226068.X、申请名称为“一种防御网络攻击的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络技术领域，尤其涉及一种防御网络攻击的方法及装置。
背景技术
随着互联网技术的发展，网络扫描、蠕虫与病毒代码的传播以及黑客恶意攻击等是网络上每台主机随时都可能面对的危险。当前的网络安全防御技术希望能在攻击破坏发生前阻止攻击活动，因此需要基于虚拟执行的检测技术，如蜜罐、蜜网等技术。当前的主流做法是通过在网络系统中布置一些蜜罐作为诱饵，诱使攻击方对它们实施攻击，从而可以对攻击行为进行捕获和分析，了解攻击方所使用的工具与方法，推测攻击意图和动机，能够让防御方清晰地了解他们所面对的安全威胁，并通过技术和管理手段来增强被保护系统的安全防护能力。蜜罐是指一种在互联网上运行的计算机系统，它通过模拟成易受攻击的真实网络、主机和服务等，作为诱惑恶意攻击的诱饵，其价值在于收集网络上的攻击活动信息，并对这些信息进行监视、检测和分析。蜜网是指诱捕这些攻击活动的整体网络体系架构，一个蜜网系统中通常包含一个或多个蜜罐。蜜网系统是为了收集入侵者的攻击信息，因而如何引诱攻击者对蜜网进行攻击是蜜网系统中一个重要的组成部分。
为了对网络系统进行全方位的安全防御，需要在网络系统中部署大量的蜜罐，而部署蜜罐需要的成本比较高，从而导致网络防御成本较高。
发明内容
本申请提供一种防御网络攻击的方法及装置，用以解决现有技术中存在网络防御成本较高的问题。
第一方面，本申请提供了一种防御网络攻击的方法，该方法包括：网络安全设备接收外部设备发送的第一报文，并将所述第一报文的目的网络协议(internet protocol，IP)地址与所述虚假网络的配置信息进行匹配。若所述虚假网络的配置信息中的一个节点的IP地址与所述目的IP地址具有相同的子网前缀，则所述网络安全设备基于虚假网络策略处理所述第一报文，若所述虚假网络的配置信息中不存在一个节点的IP地址与所述目的IP地址具有相同的子网前缀，则所述网络安全设备基于防火墙策略处理所述第一报文。其中，所述网络安全设备部署于受保护网络和所述外部设备所在的外部网络之间，所述网络安全设备中保存虚假网络的配置信息，所述配置信息中包括所述虚假网络的各个节点的网络协议IP地址，每个所述虚假网络策略包括匹配条件，以及与所述匹配条件对应的动作，所述动作包括构造并发送响应报文，或者禁止对所述第一报文进行应答，或者将所述第一报 文重定向到蜜罐设备。上述设计中，网络安全设备通过将接收到的报文与虚假网络的配置信息进行匹配，并基于虚假网络策略对接收到的报文进行响应或者不应答等处理，来向攻击者展现虚假网络拓扑，使得攻击者误以为虚假网络中的各个节点在受保护网络中真实存在，并且无法简单的通过扫描来分清这些节点中哪些是真实节点哪些是虚假节点。相比于现有技术中部署大量蜜罐的方法，本申请实施例中通过网关设备利用现有的报文匹配技术向攻击者展现虚假网络拓扑，从而可以降低真实系统首次被攻击概率，并且这种方法可以使攻击者付出更多成本进行数据分析来判断真实节点和虚假节点，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的。
一种可能的设计中，所述网络安全设备基于虚假网络策略处理所述第一报文，包括：所述网络安全设备确定所述第一报文的匹配信息，将所述第一报文的匹配信息分别与至少一个所述虚假网络策略中包含的匹配条件进行匹配，选择出与所述第一报文匹配的虚假网络策略，其中所述第一报文的匹配信息符合选择出的所述虚假网络策略中的匹配条件，之后执行选择出的所述虚假网络策略中的动作。其中，所述匹配信息包括以下至少一项：所述第一报文的协议类型、所述第一报文的目的IP地址、所述第一报文的目的端口号。上述设计中，网络安全设备可以利用现有的报文匹配技术将第一报文的匹配信息与至少一个虚假网络策略中包含的匹配条件进行匹配来选择虚假网络策略，对接收到的报文进行响应或者不应答等处理，使得攻击者误以为虚假网络中的各个节点在受保护网络中真实存在，从而可以降低真实系统首次被攻击概率，进而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的。
一种可能的设计中，选择出的所述虚假网络策略中的匹配条件为：协议类型为网络控制报文协议(internet control message protocol，ICMP)、目的IP地址是所述虚假网络中的第一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述目的IP地址可达。ICMP报文是一种用于探测IP地址是否可达的报文，上述设计中，网络安全设备通过在第一报文为ICMP报文、且第一报文的目的IP地址是虚假网络中的第一节点的IP地址时，利用现有的报文匹配技术向外部设备响应用于指示所述目的IP地址可达的报文，以使攻击者误以为受保护网络中真实存在所述第一节点，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的，或者，将第一报文重定向到蜜罐设备，使得第一报文可以被蜜罐设备进行分析检测，从而可以通过部署较少的蜜罐设备实现网络安全防御，进而可以降低网络安全防御的成本。
一种可能的设计中，所述配置信息中还包括所述虚假网络的各个节点的拓扑关系，所述响应报文携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在发往所述第一节点过程中所经过的路由节点的个数。上述设计中，网络安全设备通过告诉攻击者报文在到达所述第一节点之前进行路由转发的次数，以向攻击者展示虚假网络拓扑，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的。
一种可能的设计中，选择出的所述虚假网络策略中的匹配条件为：协议类型为ICMP、目的IP地址不是所述虚假网络中的任一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述目的IP地址不可达、且所述目的IP地址的子网前缀所对应网关设备的IP 地址可达。上述设计中，网络安全设备通过在第一报文为ICMP报文、且第一报文的目的IP地址不是虚假网络中的任一节点的IP地址时，利用现有的报文匹配技术向外部设备响应用于所述目的IP地址不可达、且所述目的IP地址的子网前缀所对应网关设备的IP地址可达的报文，以使攻击者误以为受保护网络中虽然不存在目的IP地址对应的网络设备，但是真实存在所述目的IP地址的子网前缀所对应网关设备，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的，或者，将第一报文重定向到蜜罐设备，使得第一报文可以被蜜罐设备进行分析检测，从而可以通过部署较少的蜜罐设备实现网络安全防御，进而可以降低网络安全防御的成本。
一种可能的设计中，所述配置信息中还包括所述虚假网络的各个节点的拓扑关系，所述响应报文携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在到达所述目的IP地址的子网前缀所对应的网关设备之前进行路由转发的次数。上述设计中，网络安全设备通过告诉攻击者报文在发往所述目的IP地址的子网前缀所对应的网关设备过程中所经过的路由节点的个数，以向攻击者展示虚假网络拓扑，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的。
一种可能的设计中，选择出的所述虚假网络策略中的匹配条件为：协议类型为传输控制协议(transmission control protocol，TCP)、目的端口为所述虚假网络中的第一端口，所述目的端口根据目的IP地址以及目的端口号所确定，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的端口为开放状态。TCP报文是一种用于探测网络设备中目的端口是否存在TCP服务(即端口是否为开放状态)的报文，上述设计中，网络安全设备通过在第一报文为TCP报文、目的端口为所述虚假网络中的第一端口时，利用现有的报文匹配技术向外部设备响应用于指示目的端口为开放状态的报文，以使攻击者误以为受保护网络中在所述目的IP地址对应的节点上所述目的端口号对应的端口存在开放的TCP服务，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的，或者，将第一报文重定向到蜜罐设备，使得第一报文可以被蜜罐设备进行分析检测，从而可以提高受保护网络的安全性，并且可以通过部署较少的蜜罐设备实现网络安全防御，进而可以降低网络安全防御的成本。
一种可能的设计中，选择出的所述虚假网络策略中的匹配条件为：协议类型为TCP、目的端口不为所述虚假网络中的第一端口，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的端口为未开放状态。上述设计中，网络安全设备通过在第一报文为TCP报文、且目的端口为所述虚假网络中的第一端口时，利用现有的报文匹配技术向外部设备响应用于指示目的端口为未开放状态的报文，以使攻击者误以为受保护网络中在所述目的IP地址对应的节点上所述目的端口号对应的端口不存在开放的TCP服务，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的，或者，将第一报文重定向到蜜罐设备，使得第一报文可以被蜜罐设备进行分析检测，从而可以提高受保护网络的安全性，并且可以通过部署较少的蜜罐设备实现网络安全防御，进而可以降低网络安全防御的成本。
其中，第一端口可以为根据实际需求进行设置，如第一端口可以为虚假网络的所有节点中任意一个端口号包含在第一集合中的端口，所述第一集合包括至少一个端口号；或者，第一端口还可以为所述虚假网络中第二节点上任意一个端口号包含在第二集合中的端口， 所述第二集合包括至少一个端口号，等等。
若第一端口可以为虚假网络的所有节点中任意一个端口号包含在第一集合中的端口，则选择出的所述虚假网络策略中的匹配条件为：协议类型为TCP、目的端口号是第一集合中的端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的设备上所述目的端口号对应的端口为开放状态、且所述目的设备的IP地址与所述目的IP地址相同。或者，选择出的所述虚假网络策略中的匹配条件为：协议类型为TCP、目的端口号不是第一集合中的端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的设备上所述目的端口号对应的端口为未开放状态、且所述目的设备的IP地址与所述目的IP地址相同。
若第一端口为所述虚假网络中第二节点上任意一个端口号包含在第二集合中的端口，则选择出的所述虚假网络策略中的匹配条件为：协议类型为TCP、目的IP地址是所述虚假网络中的第二节点的IP地址、目的端口号为第二集合中包括的端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示第二节点中所述目的端口号对应的端口为开放状态。或者，选择出的所述虚假网络策略中的匹配条件为：协议类型为TCP、目的IP地址不为所述虚假网络中的第二节点的IP地址和/或目的端口号不是第二集合中包括的端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的IP地址对应的节点上所述目的端口号对应的端口为未开放状态。
一种可能的设计中，选择出的所述虚假网络策略中的匹配条件为：协议类型为用户数据包协议(user datagram protocol，UDP)、目的端口为所述虚假网络中的第二端口，所述目的端口根据目的IP地址以及目的端口号所确定，选择出的所述虚假网络策略中的动作是：禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备。UDP报文是一种用于探测网络设备中目的端口是否存在UDP服务(即端口是否为开放状态)的报文，上述设计中，网络安全设备通过在第一报文为UDP报文、且目的端口为所述虚假网络中的第二端口时，利用现有的报文匹配技术不对第一报文进行应答，以使攻击者误以为受保护网络中目的端口存在开放的UDP服务，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的，或者，将第一报文重定向到蜜罐设备，使得第一报文可以被蜜罐设备进行分析检测，从而可以提高受保护网络的安全性，并且可以通过部署较少的蜜罐设备实现网络安全防御，进而可以降低网络安全防御的成本。
一种可能的设计中，选择出的所述虚假网络策略中的匹配条件为：协议类型为UDP、所目的端口不为所述虚假网络中的第二端口，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的端口不可达，或者将所述第一报文重定向到蜜罐设备。上述设计中，网络安全设备通过在第一报文为UDP报文、且不为所述虚假网络中的第二端口时，利用现有的报文匹配技术向外部设备响应用于指示目的设备中所述目的端口号对应的端口不可达的报文，以使攻击者误以为受保护网络中目的IP地址对应的节点上目的端口号对应的端口不存在开放的UDP服务，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的，或者，将第一报文重定向到蜜罐设备，使得第一报文可以被蜜罐设备进行分析检测，从而可以提高受保护网络的安全性，并且可以通过部署较 少的蜜罐设备实现网络安全防御，进而可以降低网络安全防御的成本。
其中，第二端口可以为根据实际需求进行设置，如第二端口可以为虚假网络的所有节点中任意一个端口号包含在第三集合中的端口，所述第三集合包括至少一个端口号；或者，第二端口还可以为所述虚假网络中第三节点上任意一个端口号包含在第四集合中的端口，所述第四集合包括至少一个端口号，等等。
若第二端口可以为虚假网络的所有节点中任意一个端口号包含在第三集合中的端口，则选择出的所述虚假网络策略中的匹配条件为：协议类型为UDP、目的端口号为第三集合中包括的端口号，选择出的所述虚假网络策略中的动作是：禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备。或者，选择出的所述虚假网络策略中的匹配条件为：协议类型为UDP、所述目的端口号不是第三集合中包括的端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的设备中所述目的端口号对应的端口不可达，所述目的设备的IP地址与所述目的IP地址相同，或者将所述第一报文重定向到蜜罐设备。
若第二端口还可以为所述虚假网络中第三节点上任意一个端口号包含在第四集合中的端口，则选择出的所述虚假网络策略中的匹配条件为：协议类型为UDP、目的IP地址是所述虚假网络中的第四节点的IP地址、目的端口号为第四集合中包括的端口号，选择出的所述虚假网络策略中的动作是：禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备。或者，选择出的所述虚假网络策略中的匹配条件为：协议类型为UDP、目的IP地址不为所述虚假网络中的第四节点的IP地址和/或所述目的端口号不是第四集合中包括的端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的IP地址对应的节点上所述目的端口号对应的端口不可达。
一种可能的设计中，所述网络安全设备在构造并发送响应报文时，首先构造响应报文，并延迟预设时长后发送所述响应报文。上述设计中，通过延迟发送响应报文，可以迟滞攻击活动，进而可以延长预警时间。
一种可能的设计中，选择出的所述虚假网络策略中的匹配条件为：目的IP地址是所述虚假网络中的第五节点的IP地址，选择出的所述虚假网络策略中的动作是：将所述第一报文重定向到蜜罐设备。上述设计中，网络安全设备通过在第一报文的目的IP地址为虚假网络中的第五节点的IP地址时，将第一报文重定向到蜜罐设备，使得第一报文可以被蜜罐设备进行分析检测，从而可以通过部署较少的蜜罐设备实现网络安全防御，进而可以降低网络安全防御的成本。
一种可能的设计中，所述网络安全设备在基于防火墙策略处理所述第一报文时，首先基于防火墙策略构造第一报文格式的响应报文，并向所述外部设备发送所述第一报文格式的响应报文。所述第一报文格式为第一系统类型对应的报文格式，所述第一系统类型与第一内部设备对应的第二系统类型不一致，所述第一内部设备位于所述受保护网络中，且所述第一内部设备的IP地址与所述目的IP地址相同。不同类型的操作系统发送的报文的格式不同，攻击者通过分析报文的格式确定发送该报文的网络设备的系统类型，由于不同类型的操作系统存在的漏洞不同，并攻击者针对该网络设备的系统类型存在的漏洞进行网络攻击。上述设计中，网络安全设备通过修改第一报文格式的响应报文的报文格式，以伪装网络设备的系统类型，从而隐藏了网络设备的漏洞信息，进而可以使攻击者判断网络设备 的操作系统类型时得到错误的判断结果。
一种可能的设计中，所述网络安全设备接收第二内部设备发送的第二报文之后，将所述第二报文的报文格式修改为第二报文格式，并将第二报文格式的所述第二报文进行转发。其中，所述第二内部设备为所述受保护网络中的任一设备，所述第二报文格式对应的第三系统类型与所述第二内部设备对应的第四系统类型不一致。上述设计中，网络安全设备通过修改第二报文格式的响应报文的报文格式，以伪装第二内部设备的系统类型，从而隐藏了第二内部设备的漏洞信息，进而可以使攻击者判断第二内部设备的操作系统类型时得到错误的判断结果。
第二方面，本申请提供了一种网络安全设备，执行第一方面或第一方面的任意一种可能的实现方式中的方法。具体地，该网络安全设备包括用于执行第一方面或第一方面的任意一种可能的实现方式中的方法的单元。这些单元可以由程序模块实现，也可以由硬件或固件实现，具体参见实施例中的详细描述，此处不再赘述。
第三方面，本申请提供了一种网络安全设备，该装置包括网络接口、存储器以及处理器，存储器用于存储处理器所需执行的程序代码。网络接口用于接收或发送报文。处理器用于执行存储器所存储的程序代码，具体用于执行第一方面或第一方面的任一种设计所述的方法。
第四方面，本申请还提供了一种计算机可读存储介质，用于存储为执行上述第一方面、第一方面的任意一种设计的功能所用的计算机软件指令，其包含用于执行上述第一方面、第一方面的任意一种设计的方法所设计的程序。
第五方面，本申请实施例提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意可能的设计方式中的方法。
第六方面，本申请实施例提供一种芯片系统，该芯片系统包括处理器，用于支持网络安全设备实现上述第一方面或第一方面的任意可能的设计方式中所涉及的功能。在一种可能的设计中，芯片系统还包括存储器，用于保存网络安全设备必要的程序指令和数据。芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
应理解，本申请实施例的第二至六方面与本申请实施例的第一方面的技术方案一致，各方面及对应的可实施的设计方式所取得的有益效果相似，不再赘述。
附图说明
图1为本申请提供的一种网络系统的架构示意图；
图2为本申请提供的一种虚假网络的拓扑示意图；
图3为本申请提供的一种防御网络攻击的方法流程图；
图4为本申请提供的一种应答主机扫描的方法流程图；
图5为本申请提供的一种应答TCP端口扫描的方法流程图；
图6为本申请提供的一种应答UDP端口扫描的方法流程图；
图7为本申请提供的一种延迟发送响应报文的方法流程图；
图8为本申请提供的一种防御网络攻击的方法流程图；
图9为本申请提供的一种防御网络攻击的方法流程图；
图10为本申请提供的一种处理外发报文的方法流程图；
图11为本申请提供的一种网络安全设备的结构示意图；
图12为本申请提供的一种网络安全设备的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。
本申请提供一种防御网络攻击的方法及装置，用以解决网络防御成本较高的问题。其中，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
本申请中的防御网络攻击的方法可适用于多种系统架构，图1为本申请适用的一种网络系统架构示意图。该系统包括外部设备，网络安全设备以及受保护网络，其中，网络安全设备部署于受保护网络和所述外部设备所在的外部网络之间。网络安全设备可以用于将外部设备发送给受保护网络的报文进行过滤，如允许合法报文通过或限制攻击报文通过，从而保护受保护网络免受非法用户的侵入。网络安全设备可以是一个单独的设备，也可以部署在其他设备上，如路由器设备、防火墙设备、网关设备等等。外部设备可以但不限于是计算机设备、路由器设备等。受保护网络中包括至少一个真实节点，该真实节点可以但不限于是路由器设备、计算机设备等。
攻击者进行网络攻击的过程为：首先对受保护网络进行网络扫描，其中，网络扫描包括主机扫描、传输控制协议(transmission control protocol，TCP)端口扫描以及用户数据包协议(user datagram protocol，UDP)端口扫描。主机扫描的过程为攻击者通过向受保护网络中的节点发送网络控制报文协议(internet control message protocol，ICMP)报文探测目的IP地址是否可达，受保护网络中的节点根据受保护网络的实际情况对ICMP报文进行应答，攻击者在进行了大量的ICMP报文探测之后根据接收到响应报文可以获取受保护网络的网络拓扑结构。TCP端口扫描的过程为攻击者首先向受保护网络中的节点的端口发送TCP SYN报文，如果该端口存在开放的TCP服务则该节点响应TCP SYN ACK报文，否则响应TCP RST报文。攻击者过接收到的响应报文判断该端口是否存在开放的TCP服务。在TCP报文的报头中，有几个标志字段，如SYN，ACK，RST等等，其中，SYN为同步连接序号标志位，TCP SYN报文就是把这个标志设置为1，来请求建立连接。ACK为请求/应答状态标志位，0为请求，1为应答，TCP SYN ACK报文就是把这个标志设置为1。RST为连线复位标志位，TCP RST报文就是把这个标志设置为1。UDP端口扫描的过程为攻击者首先向在进行了大量的ICMP报文探测之后发送请求连接的UDP报文，如果该端口存在开放的UDP服务则该节点不应答该UDP报文，否则应答用于指示端口不可达的ICMP报文，攻击者通过接收到的响应报文判断该端口是否存在开放的UDP服务。攻击者在进行了网络扫描之后，根据网络扫描过程中接收到的响应报文的报文格式分析受保护网络中各个节点的系统类型，并针对各个节点，根据其系统类型的漏洞对该节点进行攻击。
传统的网络安全防御技术遵循发现、分析、响应三个步骤，即：攻击者对目的设备发起攻击之后，网络安全设备采集攻击行为并对攻击行为进行分析，提取攻击特征识别码之后才能对攻击进行有效防御。但是通过这种方法使得防御滞后于攻击。以SQL Slammer为例，在它发起攻击的头10分钟里就感染了百分之九十的易攻击服务器，而特征码在48小 时之后才被提取。针对上述问题，当前的主流做法是通过在系统中部署蜜罐、蜜网等，蜜罐是指一种在互联网上运行的计算机系统，它通过模拟成易受攻击的真实网络、主机和服务等，作为诱惑恶意攻击的诱饵，其价值在于收集网络上的攻击活动信息，并对这些信息进行监视、检测和分析。蜜网是指诱捕这些攻击活动的整体网络体系架构，一个蜜网系统中通常包含一个或多个蜜罐。蜜网系统是为了收集入侵者的攻击信息，因而如何引诱攻击者对蜜网进行攻击是蜜网系统中一个重要的组成部分。部署蜜罐、蜜网的防御方法可以在攻击对真实系统造成实质破坏前实现预警和检测。蜜罐、蜜网等技术是建立在数据分析的基础上，数据分析与生成数据相比技术难度大，成本高，攻击者通过有意的构造一些数据，就很容易规避和逃逸蜜罐的检测，而蜜罐如果想识别数据的真伪，必须付出大量的技术成本。攻击者使用信息混淆技术发动攻击，就好比在一堆白米中撒入一把沙子一样容易，而蜜罐要有效实现网络安全防御，好比把沙子一粒粒从大米中筛检出来，可见，防御技术成本远远高于攻击成本。
基于此，本申请实施例通过在网络安全设备上引入发送混淆报文的技术，使网络安全设备在攻击者的网络扫描过程中应答构造的混淆报文，从而对受保护网络中的真实信息进行混淆，让受保护网络中的真实信息混杂在大量虚假信息当中，让攻击者无法识别受保护网络中的真实情况，从而要么放弃攻击，要么通过复杂的数据分析来识别信息真伪。本申请实施例中网络安全设备可以不维护TCP等网络连接状态，也可以不对网络报文在目的设备落地之后进行分析处理，而是由攻击报文触发，之后按照预定策略发送混淆报文，从而可以较低的成本实现隐藏受保护网络中的真实情况，向攻击者发送虚假信息，把攻击活动引入歧途。从而在攻击产生实际破坏前让攻击活动暴露的目的，并且发送混淆报文的方式可以将复杂的数据分析、网络连接状态维护等工作交给攻击者，使得攻击者的攻击成本增加，从而扭转攻防成本不对称问题。
本申请中所涉及的多个，是指两个或两个以上。
另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
防火墙设备是一个对接收到的网络报文进行匹配(Match)，基于匹配结果进行操作(Action)，其中Action包括阻止(block)、转发(forward)、网络地址转换(network address translation，NAT)等等，从而进行报文控制实现安全防护的设备。本申请实施例中网络安全设备保持防火墙设备的基本工作流程，通过保存虚假网络的配置信息，使网络安全设备可以在攻击者进行网络扫描时基于虚假网络策略构造响应报文来欺骗攻击者，从而可以隐藏受保护网络的真实信息，诱导攻击者向虚假网络发动攻击，降低受保护网络被攻击的概率。其中，虚假网络的配置信息中包括虚假网络的各个节点的网络协议IP地址，还可以包括各个节点的拓扑关系，例如，如图2所示，虚假网络的配置信息中可以包括三个网关节点，网络协议(internet protocol，IP)地址分别为202.14.235.254、202.14.236.254、202.14.237.254。其中，IP地址为202.14.235.254的网关节点分别与IP地址为202.14.236.254的网关节点以及IP地址为202.14.237.254的网关节点相连接。IP地址为202.14.235.254的网关节点连接一个端节点，该端节点的IP地址为202.14.235.1。IP地址为202.14.236.254的网关节点连接两个端节点，这两个端节点的IP地址分别为202.14.236.1以及202.14.236.2。IP地址为202.14.237.254的网关节点连接两个端节点，这两个端节点的IP地址分别为202.14.237.1以及202.14.237.2。每个 虚假网络策略包括匹配条件，以及与所述匹配条件对应的动作，所述动作包括构造并发送响应报文，或者禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备等等。
参见图3，为本申请提供的网络安全设备防御网络攻击的方法流程图。该方法可以用于图1所示的网络系统中，该方法包括：
S301，网络安全设备接收外部设备发送的第一报文。
S302，所述网络安全设备将所述第一报文的目的IP地址与所述虚假网络的配置信息进行匹配。
具体的，网络安全设备可以先获取第一报文的五元组信息，其中，五元组信息指网络报文的协议类型、源IP、源端口、目的IP地址、目的端口，并将第一报文的五元组信息中的目的IP地址与虚假网络的配置信息进行匹配。
若所述虚假网络的配置信息中的一个节点的IP地址与所述目的IP地址具有相同的子网前缀，则执行步骤S303。
S303，所述网络安全设备基于虚假网络策略处理所述第一报文。
若所述虚假网络的配置信息中不存在一个节点的IP地址与所述目的IP地址具有相同的子网前缀，则执行步骤S304。
S304，所述网络安全设备基于防火墙策略处理所述第一报文。
其中，防火墙策略为现有技术中防火墙设备处理网络报文时所采用的策略。现有技术中的防火墙策略可以包括两部分，即匹配部分和操作部分，匹配部分即对网络报文进行五元组信息匹配，操作部分为根据匹配部分得到的匹配结果按照预设策略对网络报文或者流量进行操作，操作可以为丢弃(Drop)、拒绝(Reject)、接受(Accept)、跳转(Jump)等等，具体的，防火墙策略可以通过如下代码实现：
-p TCP-s 192.168.0.0/16-d 0.0.0.0/0--dport＝80-j DROP//防火墙在接收到源IP地址的子网前缀为192.168.0.0/16，目的端口号为80的TCP报文后，丢弃该TCP报文；
-p TCP-s 192.168.0.0/16-d 10.10.10.1/32--dport＝22-j Accept//防火墙允许源IP地址的子网前缀为192.168.0.0/16，目的IP地址为10.10.10.1，目的端口号为22的TCP报文通过。
本申请实施例中网络安全设备通过将接收到的报文与虚假网络的配置信息进行匹配，并基于虚假网络策略对接收到的报文进行响应或者不应答等处理，来向攻击者展现虚假网络拓扑，使得攻击者误以为虚假网络中的各个节点在受保护网络中真实存在，并且无法简单的通过扫描来分清这些节点中哪些是真实节点哪些是虚假节点。相比于现有技术中部署大量蜜罐的方法，本申请实施例中通过网关设备利用现有的报文匹配技术向攻击者展现虚假网络拓扑，从而可以降低真实系统首次被攻击概率，并且这种方法可以使攻击者付出更多成本进行数据分析来判断真实节点和虚假节点，从而可以以较低的成本实现干扰、误导攻击者的攻击活动的目的。
以图2所示的虚假网络为例，网络安全设备在将第一报文的五元组信息与虚假网络的配置信息进行匹配时，可以通过如下代码实现，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该匹配条件对应的动作：
<Any_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.0/24> <Any_DestPort>：报文处理；//针对目的IP地址的子网前缀为202.14.235.0/24的报文，基于虚假网络策略对其进行报文处理，如构造响应报文、不应答、重定向到蜜罐设备；
<Any_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.236.0/24><Any_DestPort>：报文处理；//针对目的IP地址的子网前缀为202.14.236.0/24的报文，基于虚假网络策略对其进行报文处理，如构造响应报文、不应答、重定向到蜜罐设备；
<Any_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.0/24><Any_DestPort>：报文处理；//针对目的IP地址的子网前缀为202.14.237.0/24的报文，基于虚假网络策略对其进行报文处理，如构造响应报文、不应答、重定向到蜜罐设备。
网络安全设备在基于虚假网络策略处理第一报文时，可以通过如下方式实现：
A1，所述网络安全设备确定所述第一报文的匹配信息，所述匹配信息包括以下至少一项：所述第一报文的协议类型，所述第一报文的目的IP地址，所述第一报文的目的端口号。
具体的，网络安全设备可以通过分析第一报文的五元组信息确定所述第一报文的匹配信息。
A2，所述网络安全设备将所述第一报文的匹配信息分别与至少一个所述虚假网络策略中包含的匹配条件进行匹配，选择出与所述第一报文匹配的虚假网络策略，其中所述第一报文的匹配信息符合选择出的所述虚假网络策略中的匹配条件。
A3，所述网络安全设备执行选择出的所述虚假网络策略中的动作。
为了更好地理解本发明实施例，下面以图2所示的虚假网络为例，结合攻击者的网络扫描过程对本申请实施例提供的虚假网络策略进行具体说明。
针对攻击者发起的主机扫描，本申请实施例中网络安全设备通过保存虚假网络的配置信息，并将攻击者发送的ICMP报文的IP地址与虚假网络的配置信息进行匹配，并基于虚假网络策略构造响应报文，从而向攻击者展现虚假的网络拓扑，如图4所示：
S401，网络安全设备接收外部设备发送的ICMP报文。
S402，网络安全设备将ICMP报文的五元组信息与各个虚假网络策略中的匹配条件进行匹配，并基于匹配结果选择虚假网络策略，其中，选择的虚假网络策略中的匹配条件与ICMP报文的五元组信息相匹配。
S403，网络安全设备基于选择的虚假网络策略构造响应报文。
S404，网络安全设备将构造的响应报文发送给外部设备。
其中，选择的虚假网络策略可以为虚假网络策略一。虚假网络策略一为：匹配条件为：协议类型为ICMP、目的IP地址是所述虚假网络中的某个节点的IP地址，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示所述目的IP地址可达。此外，所述响应报文还可以携带生存时间，所述生存时间为所述网络安全设备基于所述虚假网络的拓扑关系所确定的，且所述生存时间表示报文在发送所述第一节点过程中所经过的路由节点的个数。根据图2所示的虚假网络的配置信息，网络安全设备可以通过如下代码实现该虚假网络策略一，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.254/32><Any_DestPort>：<NODE><TTL-0>//说明受保护网络中存在网络节点的IP地址为202.14.235.254，且应答的TTL需要减0；
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.236.254/32><Any_DestPort>：<NODE><TTL-1>//说明202.14.236.254对应的节点为受保护网络中的网络节点，且应答的TTL需要减1；
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.254/32><Any_DestPort>：<NODE><TTL-1>//说明202.14.237.254对应的节点为受保护网络中的网络节点，且应答的TTL需要减1；
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.5/32><Any_DestPort>：<NODE><TTL-1>//说明202.14.235.5对应的节点为受保护网络中的网络节点，且应答的TTL需要减1；
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.236.1/32><Any_DestPort>：<NODE><TTL-2>//说明202.14.236.1对应的节点为受保护网络中的网络节点，且应答的TTL需要减2；
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.236.2/32><Any_DestPort>：<NODE><TTL-2>//说明202.14.236.2对应的节点为受保护网络中的网络节点，且应答的TTL需要减2；
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.1/32><Any_DestPort>：<NODE><TTL-2>//说明202.14.237.1对应的节点为受保护网络中的网络节点，且应答的TTL需要减2；
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.2/32><Any_DestPort>：<NODE><TTL-2>//说明202.14.237.2对应的节点为受保护网络中的网络节点，且应答的TTL需要减2。
选择的虚假网络策也可以为虚假网络策略二。虚假网络策略二为：匹配条件为：协议类型为ICMP、目的IP地址为第一IP地址，其中，所述第一IP地址不是所述虚假网络中的任一节点的IP地址且所述第一IP地址与所述虚假网络中某个节点具有相同的子网前缀，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示所述目的IP地址不可达、且所述目的IP地址的子网前缀所对应网关设备的IP地址可达。此外，所述响应报文还可以携带生存时间，所述生存时间为所述网络安全设备基于所述虚假网络的拓扑关系所确定的，且所述生存时间表示报文在发送所述目的IP地址的子网前缀所对应网关设备过程中所经过的路由节点的个数。根据图2所示的虚假网络的配置信息，以所述第一IP地址为202.14.235.8/32为例，网络安全设备可以通过如下代码实现该虚假网络策略二，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.8/32><Any_DestPort>：<NETWORK><GW＝202.14.235.254><TTL-1>//受保护网络中不存在IP地址为202.14.235.8/32的节点，且存在IP地址为202.14.235.254的网关。且应答的TTL需要减1。
此外，若所述虚假网络的配置信息中不存在一个节点的IP地址与所述目的IP地址具 有相同的子网前缀，且受保护网络中也不存在一个节点的IP地址与所述目的IP地址具有相同的子网前缀，则网络设备还可以构造并发送响应报文，所述响应报文用于指示所述目的IP地址不可达。网络安全设备可以通过如下代码实现，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该匹配条件对应的动作：
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>-><Some_DestIP><Any_DestPort>:<UNREACHABLE>//对于目的IP地址为Some_DestIP的报文，都返回主机不可达报文，其中，Some_DestIP既不在虚假网络中，也不在受保护网络中。
以既不在虚假网络中，也不在受保护网络中的202.14.230.0/24为例，网络安全设备可以向目的IP地址的子网前缀为202.14.230.0/24的ICMP报文响应主机不可达报文，可以通过如下代码实现，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该匹配条件对应的动作：
<ICMP_Potocal><Any_SourceIP><Any_SourcePort>-><202.14.230.0/24><Any_DestPort>:<UNREACHABLE>：//对于目的IP地址的子网前缀为202.14.230.0/24的ICMP报文，发送主机不可达报文。
以该第一报文为目的IP地址为202.14.237.2的ICMP回应请求(Echo Request)报文为例，网络安全设备确定该ICMP Echo Request报文符合“<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.2/32><Any_DestPort>”，则根据虚假网络策略一中“<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.2/32><Any_DestPort>：<NODE><TTL-2>”构造一个源IP地址为202.14.237.2，TTL减2的ICMP响应(Echo Reply)报文，并发送给外部设备，使外部设备认为202.14.237.2在网络安全设备的受保护网络中真实存在，并且使外部设备确定202.14.237.2在受保护网络中的位置，即在第一报文在发送202.14.237.2过程中，需要经过2个路由节点。
以该第一报文为目的IP地址为202.14.235.8的ICMP Echo Request报文为例，网络安全设备确定该ICMP Echo Request报文符合“<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.8/32><Any_DestPort>”，则根据虚假网络策略二中“<ICMP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.8/32><Any_DestPort>：<NETWORK><GW＝202.14.235.254><TTL-2>”构造一个“存在IP地址为202.14.235.254的网关节点，且TTL减1”的ICMP Echo Reply报文，并发送给外部设备，使外部设备相信202.14.235.8在网络安全设备的受保护网络中不存在，且其子网前缀对应的网关节点在受保护网络中真实存在，该网关节点的IP地址为202.14.235.254，且在第一报文在发往202.14.235.254过程中，需要经过2个路由节点。
以第一报文为IP地址为202.14.239.11/32的ICMP Echo Request报文为例，网络安全设备确定该ICMP Echo Request报文的目的IP地址既不在虚假网络中，也不在受保护网络中，则构造一个主机不可达报文。
这样，当攻击者进行了大量的ICMP报文探测后，将会获取网络安全设备的受保护网络的网络拓扑图。本申请实施例中网络安全设备基于虚假网络的配置信息以及虚假网络策略构造响应报文向攻击者进行发送，可以使攻击者获取到不真实的网络拓扑图，从而可以干扰、误导攻击者的攻击行为，进而可以降低受保护网络的被攻击的概率，并且还可以促 使攻击者进行数据分析以辨别信息的真伪，从而增加攻击者的攻击成本。
针对攻击者发起的TCP端口扫描过程，本申请实施例中网络安全设备在接收到攻击者发送的TCP报文后，与虚假网络策略中的匹配条件进行匹配，并基于匹配成功的虚假网络策略构造SYN ACK报文或者RST报文来对攻击者展现虚假网络中不存在的TCP服务，如图5所示：
S501，网络安全设备接收外部设备发送的TCP报文。
S502，网络安全设备将TCP报文的五元组信息与各个虚假网络策略中的匹配条件进行匹配，并基于匹配结果选择虚假网络策略，其中，选择的虚假网络策略中的匹配条件与TCP报文的五元组信息相匹配。
S503，网络安全设备基于选择的虚假网络策略构造响应报文。
S504，网络安全设备将构造的响应报文发送给外部设备。
其中，选择的虚假网络策略可以为虚假网络策略三。虚假网络策略三为：匹配条件为：协议类型为TCP、目的端口为虚假网络中的第一端口，其中，目的端口根据目的IP地址以及目的端口所确定，则对应的动作是：构造并发送响应报文，其中所述响应报文用于指示目的端口为开放状态。
选择的虚假网络策略也可以为虚假网络策略四。虚假网络策略四为：匹配条件为：协议类型为TCP、目的端口为虚假网络中的第二端口，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的端口不为开放状态。
所述第一端口可以为虚假网络中的任意端口，如，所述第一端口可以为虚假网络中IP地址的子网前缀为202.14.236.0/24的所有节点上端口号为1～1024的端口，或者，所述第一端口可以为虚假网络中IP地址为202.14.236.1的节点上端口号为1～1024的端口，等等，本申请实施例在这里不做具体限定。所述第二端口可以为虚假网络中与所述第一端口不同的任意端口。
以所述第一端口为虚假网络中IP地址的子网前缀为202.14.236.0/24的所有节点上端口号为1～1024的端口，所述第二端口为虚假网络中目的IP地址的子网前缀为202.14.235.0/24的节点的任一端口、或者目的IP地址的子网前缀为202.14.237.0/24的节点的任一端口、或者目的IP地址的子网前缀为202.14.236.0/24的所有节点上端口号为1025～65535的端口为例，虚假网络策略三可以为：匹配条件为：协议类型为TCP、目的IP地址的子网前缀为202.14.236.0/24，目的端口号包含在{1，2，3……1023，1024}中，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的设备中所述目的端口号对应的端口为开放状态、且所述目的设备的IP地址与所述目的IP地址相同。网络安全设备可以通过如下代码实现该虚假网络策略三，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.0/24><TCP_Port＝1:1024>:<TCP><TCP_SYN ACK>//IP地址的子网前缀为202.14.236.0/24的节点中端口号为1至1024的端口存在开放的TCP服务。
虚假网络策略四可以为：匹配条件为：协议类型为TCP、且目的IP地址的子网前缀为202.14.235.0/24，或者，匹配条件为：协议类型为TCP、且目的IP地址的子网前缀为202.14.237.0/24，或者，匹配条件为：协议类型为TCP、且目的IP地址的子网前缀为 202.14.236.0/24、目的端口号包含在{1025，1026，1027……65534，65535}中，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的设备中所述目的端口号对应的端口为未开放状态、且所述目的设备的IP地址与所述目的IP地址相同。网络安全设备可以通过如下代码实现该虚假网络策略四，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.235.0/24><Any_DestPort>:<TCP><TCP_RST>//IP地址的子网前缀为202.14.235.0/24的节点中的端口不存在开放的TCP服务；
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.237.0/24><Any_DestPort>:<TCP><TCP_RST>//IP地址的子网前缀为202.14.237.0/24的节点中的端口不存在开放的TCP服务；
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.0/24><TCP_Port＝1025:65535>:<TCP_RST>//IP地址的子网前缀为202.14.236.0/24的节点中端口号为1025至65535的端口不存在开放的TCP服务。
以该第一报文为目的IP地址为202.14.236.2，目的端口号为566的TCP报文为例，网络安全设备确定该TCP报文符合“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.0/24><TCP_Port＝1:1024>”，则根据虚假网络策略三中“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.0/24><TCP_Port＝1:1024>:<TCP><TCP_SYN ACK>”构造SYN ACK报文并向外部设备进行发送，使外部设备相信202.14.236.2的端口号为566的端口存在开放的TCP服务。
以该第一报文为目的IP地址为202.14.237.2，目的端口号为2566的TCP报文为例，网络安全设备确定该TCP报文符合“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.237.0/24><Any_DestPort>”，则基于虚假网络策略四中“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.237.0/24><Any_DestPort>:<TCP><TCP_RST>”构造RST报文并向外部设备进行发送，使外部设备相信202.14.237.2的端口号为2566的端口不存在开放的TCP服务。
这样，当攻击者进行了大量的TCP端口扫描后，会认为虚假网络中子网前缀为202.14.236.0/24的所有IP对应的节点中端口号为1～1024的端口存在开放的TCP服务，虚假网络中的其他端口不存在开放的TCP服务。
以所述第一端口为虚假网络中IP地址为202.14.236.1的节点中端口号为1～1024的端口，所述第二端口为虚假网络中目的IP地址的子网前缀为202.14.235.0/24的节点上的任一端口、或者目的IP地址的子网前缀为202.14.237.0/24的节点上的任一端口、或者目的IP地址为202.14.236.2/32的节点上的任一端口、或者目的IP地址为202.14.236.1/32的节点上端口号为1025～65535的端口为例，虚假网络策略三可以为：匹配条件为：协议类型为TCP、目的IP地址为202.14.236.1、目的端口号包含在{1，2，3……1023，1024}中，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的IP地址对应的节点上所述目的端口号对应的端口为开放状态。网络安全设 备可以通过如下代码实现该虚假网络策略，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.1/32><TCP_Port＝1:1024>:<TCP><TCP_SYN ACK>//IP地址为202.14.236.1的节点中端口号为1至1024的端口存在开放的TCP服务。
虚假网络策略四可以为：匹配条件为：协议类型为TCP、目的IP地址的子网前缀为202.14.235.0/24，或者，匹配条件为：协议类型为TCP、目的IP地址的子网前缀为202.14.237.0/24，或者，匹配条件为：协议类型为TCP、目的IP地址为202.14.236.2/32，或者，匹配条件为：协议类型为TCP、目的IP地址为202.14.236.1/32、目的端口号包含在{1025，1026，1027……65534，65535}中，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的IP地址对应的节点上所述目的端口号对应的端口为未开放状态。网络安全设备可以通过如下代码实现该虚假网络策略，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.235.0/24><Any_DestPort>:<TCP><TCP_RST>//IP地址的子网前缀为202.14.235.0/24的节点中的端口不存在开放的TCP服务；
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.237.0/24><Any_DestPort>:<TCP><TCP_RST>//IP地址的子网前缀为202.14.237.0/24的节点中的端口不存在开放的TCP服务；
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.2/32><Any_DestPort>:<TCP_RST>//IP地址为202.14.236.2的节点中端口均不存在开放的TCP服务；
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.1/32><TCP_Port＝1025:65535>:<TCP_RST>//IP地址为202.14.236.1的节点中端口号为1025至65535的端口不存在开放的TCP服务。
以该第一报文为目的IP地址为202.14.236.1，目的端口号为566的TCP报文为例，网络安全设备确定该TCP报文符合“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.1/32><TCP_Port＝1:1024>”，则基于虚假网络策略三种“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.1/32><TCP_Port＝1:1024>:<TCP><TCP_SYN ACK>”构造SYN ACK报文并向外部设备进行发送，使外部设备相信202.14.236.1的端口号为566的端口存在开放的TCP服务。
以该第一报文为目的IP地址为202.14.237.2，目的端口号为2566的TCP报文为例，网络安全设备确定该TCP报文符合“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.237.0/24><Any_DestPort>”，则基于虚假网络策略四中“<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.237.0/24><Any_DestPort>:<TCP><TCP_RST>”构造RST报文并向外部设备进行发送，使外部设备相信202.14.237.2的端口号为2566的端口不存在开放的TCP服务。
这样，当攻击者进行了大量的TCP端口扫描后，会认为虚假网络中IP地址为 202.14.236.1的节点中端口号为1～1024的端口存在开放的TCP服务，虚假网络中的其他端口不存在开放的TCP服务。
针对攻击者发起的UDP端口扫描过程，本申请实施例中网络安全设备在接收到攻击者发送的UDP报文后，与虚假网络策略中的匹配条件进行匹配，并基于匹配成功的虚假网络策略不应答或者构造用于指示端口不可达的ICMP报文来对攻击者展现虚假网络中不存在的UDP服务，如图6所示：
S601，网络安全设备接收外部设备发送的UDP报文。
S602，网络安全设备将UDP报文的五元组信息与各个虚假网络策略中的匹配条件进行匹配，并基于匹配结果选择虚假网络策略，其中，选择的虚假网络策略中的匹配条件与TCP报文的五元组信息相匹配。
S603，网络安全设备基于选择的虚假网络策略构造响应报文或者不应答。
S604，网络安全设备将构造的响应报文发送给外部设备。
其中，选择的虚假网络策略可以为虚假网络策略五。虚假网络策略五为：匹配条件为：协议类型为UDP、目的端口为虚假网络中的第三端口，则对应的动作是：不对所述UDP报文进行应答。
选择的虚假网络策略也可以为虚假网络策略六。虚假网络策略六为：匹配条件为：协议类型为UDP、目的端口为虚假网络中的第四端口，则对应的动作是：构造并发送响应报文，其中所述响应报文用于指示目的端口不可达。
所述第三端口可以为虚假网络中的任意端口，如，所述第三端口可以为虚假网络中IP地址为202.14.237.1的节点中端口号为53的端口，所述第三端口也可以为虚假网络中IP地址的子网前缀为202.14.236.0/24的所有节点上端口号1～1024的端口，等等，本申请实施例在这里不做具体限定。所述第四端口可以为虚假网络中与所述第三端口不同的任意端口。
以所述第三端口为虚假网络中IP地址为202.14.237.1的节点中端口号为53的端口，所述第四端口为虚假网络中目的IP地址的子网前缀为202.14.235.0/24的节点的任一端口、或者目的IP地址的子网前缀为202.14.236.0/24的节点的任一端口、或者目的IP地址为202.14.237.1/32的节点上端口号为1～52以及54～65535的端口、或者目的IP地址为202.14.237.2/32的节点上的任一端口为例，虚假网络策略五可以为：匹配条件为：协议类型为UDP、目的IP地址为202.14.237.1、目的端口号为53，该虚假网络策略中的动作是：不应答。网络安全设备可以通过如下代码实现该虚假网络策略五，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.1/32><UDP_Port＝53>:<不应答>//IP地址为202.14.237.1的节点中端口号为53的端口存在开放的UDP服务。
虚假网络策略六可以为：匹配条件为：协议类型为UDP、且目的IP地址的子网前缀为202.14.235.0/24，或者，匹配条件为协议类型为UDP、且目的IP地址的子网前缀为202.14.236.0/24，或者，匹配条件为协议类型为UDP、目的IP地址为202.14.237.1/32、目的端口号包含在{1，2，3……51，52，54，55……65534，65535}中，或者，匹配条件为协议类型为UDP、目的IP地址为202.14.237.2/32，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示第三节点中所述目的端口号对应的端口为未 开放状态。网络安全设备可以通过如下代码实现该虚假网络策略，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.235.0/24><Any_DestPort>:<ICMP><端口不可达>//IP地址的子网前缀为202.14.235.0/24的节点中的端口均不存在开放的UDP服务；
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.236.0/24><Any_DestPort>:<ICMP><端口不可达>//IP地址的子网前缀为202.14.236.0/24的节点中的端口均不存在开放的UDP服务；
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.1/32><UDP_Port＝1:52、54：65535>:<ICMP><端口不可达>//IP地址为202.14.236.1的节点中端口号为1025至65535的端口不存在开放的UDP服务；
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.2/32><Any_DestPort>:<ICMP><端口不可达>//IP地址为202.14.237.2的节点中的端口均不存在开放的UDP服务。
以该第一报文为目的IP地址为202.14.237.1，目的端口号为53的UDP报文为例，网络安全设备确定该UDP报文符合“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.1/32><UDP_Port＝53>”，则基于虚假网络策略五中“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.1/32><UDP_Port＝53>:<不应答>”不对所述UDP报文进行应答，从而使外部设备相信IP地址为202.14.237.1的节点中端口号为53的端口存在开放的UDP服务。
以该第一报文为目的IP地址为202.14.237.2，目的端口号为2566的UDP报文为例，网络安全设备确定该UDP报文符合“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.2/32><Any_DestPort>”，则基于虚假网络策略六中“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.2/32><Any_DestPort>:<ICMP><端口不可达>”构造用于指示IP地址为202.14.237.2的节点上端口号为2566的端口不可达的ICMP报文并向外部设备进行发送，使外部设备相信202.14.237.2的端口号为2566的端口不存在开放的UDP服务
因此，当攻击者进行了大量的UDP端口扫描后，会认为虚假网络中IP地址为202.14.236.1的节点中端口号为1～1024的端口存在开放的UDP服务，虚假网络中的其他端口不存在服务。
以所述第三端口为虚假网络中IP地址的子网前缀为202.14.236.0/24的所有节点上端口号1～1024的端口，所述第四端口为虚假网络中目的IP地址的子网前缀为202.14.235.0/24的节点的任一端口、或者目的IP地址的子网前缀为202.14.237.0/24的节点的任一端口、或者目的IP地址的子网前缀为202.14.236.0/24的节点上端口号为1025～65535的端口为例，虚假网络策略五可以为：匹配条件为：协议类型为UDP、目的IP地址的子网前缀为202.14.236.0/24，目的端口号包含在{1，2，3……1023，1024}中，该虚假网络策略中的动作是：不应答。网络安全设备可以通过如下代码实现该虚假网络策略，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—> <202.14.236.0/24><UDP_Port＝1:1024>:<不应答>//IP地址的子网前缀为202.14.236.0/24的节点中端口号为1至1024的端口存在开放的UDP服务。
虚假网络策略六可以为：匹配条件为：协议类型为UDP、且目的IP地址的子网前缀为202.14.235.0/24，或者，匹配条件为协议类型为UDP、且目的IP地址的子网前缀为202.14.237.0/24，或者，匹配条件为协议类型为UDP、目的IP地址的子网前缀为202.14.236.0/24、目的端口号包含在{1025，1025……65534，65535}中，该虚假网络策略中的动作是：构造并发送响应报文，其中所述响应报文用于指示目的设备中所述目的端口号对应的端口为未开放状态、且所述目的设备的IP地址与所述目的IP地址相同。网络安全设备可以通过如下代码实现该虚假网络策略，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.235.0/24><Any_DestPort>:<ICMP><端口不可达>//IP地址的子网前缀为202.14.235.0/24的节点中的端口不存在开放的UDP服务；
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.0/24><Any_DestPort>:<ICMP><端口不可达>//IP地址的子网前缀为202.14.237.0/24的节点中的端口不存在开放的UDP服务；
<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.236.0/24><UDP_Port＝1025:65535>:<ICMP><端口不可达>//IP地址的子网前缀为202.14.236.0/24的节点中端口号为1025至65535的端口不存在开放的UDP服务。
以该第一报文为目的IP地址为202.14.236.2，目的端口号为566的UDP报文为例，网络安全设备确定该UDP报文符合“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.236.0/24><Any_DestPort>”，则基于虚假网络策略五中“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.236.0/24><UDP_Port＝1:1024>:<不应答>”不应答所述UDP报文，使外部设备相信202.14.236.2的端口号为566的端口存在开放的UDP服务。
以该第一报文为目的IP地址为202.14.237.2，目的端口号为2566的UDP报文为例，网络安全设备确定该UDP报文符合“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.0/24><Any_DestPort>”，则基于虚假网络策略六中“<UDP_Potocal><Any_SourceIP><Any_SourcePort><UDP_SYN＝1>—><202.14.237.0/24><Any_DestPort>:<ICMP><端口不可达>”构造用于指示IP地址为202.14.237.2的节点上端口号为2566的端口不可达的ICMP报文并向外部设备进行发送，使外部设备相信202.14.237.2的端口号为2566的端口不存在开放的UDP服务。因此，当攻击者进行了大量的UDP端口扫描后，会认为虚假网络中子网前缀为202.14.236.0/24的所有IP对应的节点中端口号为1～1024的端口存在开放的UDP服务，虚假网络中的其他端口不存在开放的UDP服务。
网络安全设备在攻击者发起的网络扫描过程中，还可以在基于虚假网络策略构造响应报文之后，延迟预设时长后发送该响应报文，如图7所示，从而可以拖延建立每个会话的时间。在延时过程中，攻击者需要保持等待回话的状态，从而可以消耗攻击者大量的资源，进而减慢了攻击者进行网络扫描的速度。假设正常情况下，网络设备对一个TCP报文进行 响应的时间为2秒，那么攻击者完成对254个网络设备的TCP端口扫描用时大概8分钟，而本申请实施例中网络安全设备在构造响应报文之后延迟预设时长后发送响应报文，若所述预设时长为20秒，则攻击者完成对254个网络设备的TCP端口扫描需要花费大概85分钟，从而可以极大的降低攻击者的扫描速度。
网络安全设备可以在虚假网络策略中指定延迟的时间，如，以所述第一端口为虚假网络中IP地址的子网前缀为202.14.236.0/24的所有节点上端口号为1～1024的端口时的虚假网络策略三，预设时间为40秒为例，在该虚假网络策略三指定延迟的时间可以通过如下代码实现，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为该虚假网络策略中的动作：
<TCP_Potocal><Any_SourceIP><Any_SourcePort><TCP_SYN＝1>—><202.14.236.0/24><TCP_Port＝1:1024>:<TCP><TCP_SYN ACK><Delay＝40>//发送SYN ACK报文前延迟40秒。
通过延迟发送响应报文的方法，攻击者在对虚假网络中节点的端口做TCP端口扫描时，攻击者发送的TCP报文会在延迟40秒钟后得到应答，而在此期间攻击者必须维护等待TCP报文应答的状态，从而可以会极大消耗攻击者的资源，迫使攻击者降低扫描和攻击的速度，减缓了攻击扩散。
网络安全设备接收到的发送给虚假网络的报文，无论行为是否包含已知攻击特征，都是需要高度怀疑的行为，因此网络安全设备还可以将发送给虚假网络的报文重定向到蜜罐设备进行分析。网络安全设备将发送给虚假网络的报文重定向到蜜罐设备时，可以将所有发送给虚假网络的报文重定向到蜜罐设备，也可以将部分发送给虚假网络的报文重定向到蜜罐设备，本申请实施例在这里不做具体限定。
下面以网络安全设备将发送给虚假网络的TCP报文重定向到蜜罐为例，对网络安全设备基于虚假网络策略处理第一报文的过程进行具体说明，如图8所示：
S801，网络安全设备接收第一报文。
若所述第一报文为ICMP报文，执行步骤S802。
S802，网络安全设备基于虚假网络策略一或者虚假网络策略二构造响应报文。
若所述第一报文为TCP报文，执行步骤S803。
S803，网络安全设备将第一报文重定向到蜜罐设备。网络安全设备可以通过如下代码实现，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为对应的动作：
<TCP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.0/24><Any_DestPort>:<重定向><蜜罐所在IP地址>//将目的IP地址的子网前缀为202.14.235.0/24的TCP报文重定向到蜜罐设备；
<TCP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.236.0/24><Any_DestPort>:<重定向><蜜罐所在IP地址>//将目的IP地址的子网前缀为202.14.236.0/24的TCP报文重定向到蜜罐设备；
<TCP_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.0/24><Any_DestPort>:<重定向><蜜罐所在IP地址>//将目的IP地址的子网前缀为202.14.237.0/24的TCP报文重定向到蜜罐设备。
若所述第一报文为UDP报文，执行步骤S804。
S804，网络安全设备基于虚假网络策略五或者虚假网络策略六构造响应报文。
下面以网络安全设备将发送给虚假网络的所有报文重定向到蜜罐为例，对网络安全设备基于虚假网络策略处理第一报文的过程进行具体说明，如图9所示：
S901，网络安全设备接收第一报文。
S902，网络安全设备将第一报文重定向到蜜罐设备。
网络安全设备可以通过如下代码实现，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为对应的动作：
<Any_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.235.0/24><Any_DestPort>:<重定向><蜜罐所在IP地址>//将目的IP地址的子网前缀为202.14.235.0/24的报文重定向到蜜罐设备；
<Any_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.236.0/24><Any_DestPort>:<重定向><蜜罐所在IP地址>//将目的IP地址的子网前缀为202.14.236.0/24的报文重定向到蜜罐设备；
<Any_Potocal><Any_SourceIP><Any_SourcePort>—><202.14.237.0/24><Any_DestPort>:<重定向><蜜罐所在IP地址>//将目的IP地址的子网前缀为202.14.237.0/24的报文重定向到蜜罐设备。
网络安全设备在将第一报文重定向到蜜罐设备时，可以通过端口转发技术，即网络安全设备将虚假网络中各节点的端口与蜜罐设备的端口映射起来，之后网络安全设备在接收到发送给虚假网络的TCP报文时将该TCP报文转发给蜜罐设备。
或者，网络安全设备也可以通过隧道技术将第一报文重定向到蜜罐设备，即在网络安全设备和蜜罐设备之间建立一条网络隧道，网络安全设备将第一报文直接封装在网络隧道中转发到蜜罐设备，蜜罐设备可以通过隧道获得第一报文并且进行处理，处理之后可把需要返回的网络报文通过隧道返回网络安全设备，再由网络安全设备发送给外部设备或者受保护网络。
或者，网络安全设备也可以其他等技术将第一报文重定向到蜜罐设备，本申请实施例在这里不做具体限定。
通过将怀疑度较高的报文重定向到蜜罐设备进行分析，可以提高受保护网络的安全性。相比于现有技术中蜜罐设备处理大量的报文，本申请实施例将怀疑度比较高的报文提交该蜜罐设备进行分析，可以把蜜罐等设备从处理大量正常流量中解放出来，提高了蜜罐等设备的使用效率，进而降低网络安全防御的成本。
攻击者在进行网络扫描之后，根据网络扫描过程中接收的响应报文的某些可以暴露系统类型的特征字段确定节点的系统类型，从而针对该系统类型的漏洞发动网络攻击。在IP、TCP、UDP协议中，能够暴露系统类型的特征字段有：IP分组字段：该字段包括IP ID标识等，而不同类型的系统发送的IP报文中的IP ID不同。TCP分组字段：该字段包括初始序列号(ISN)、TCP初始窗口大小(initial window size)、TCP选项(TCP options)中的类型、数值以及它们在分组中的顺序，而不同类型的系统发送的TCP报文中的初始序列号(ISN)、TCP初始窗口大小(initial window size)、TCP选项(TCP options)中的类型、数值以及它们在分组中的顺序不同。UDP分组字段：当网络设备接收到一个针对不存在的UDP服务端口的UDP服务请求报文时，会回应一种ICMP差错控制报文，即端口不可达报文，它是“ICMP目的不可到达”报文中的一种，而不同类型的系统对“ICMP消息引用”部分的实现不同，也就是，不同类型的系统实现“ICMP消息引用”的相关字段不同。
下面是攻击者常用的一些系统类型识别方法，这些方法中所涉及的TCP/IP协议中特定的字段即能够暴露系统类型的特征字段：
一种方法为，根据TCP传输控制协议RFC793的规定，节点在接收到TCP FIN报文后不会响应该报文，但是系统类型为MS Windows、BSDI、CISCO、HP/UX、MVS和IRIX等的节点在接收到TCP FIN报文后会发回一个RESET响应报文。因此攻击者可以利用这个特征来识别系统类型。
另一种方法为，系统类型为新版本的Solaris、IRIX、FreeBSD、Digital UNIX、Cray等的节点在响应一个TCP SYN报文时选择的初始化序列数(initial sequence number，ISN)为随机增量。系统类型为老版本UNIX的节点在响应一个TCP SYN报文时选择的ISN为64K，系统类型为Linux 2.0.x，OpenVMS，新的AIX等的节点在响应一个TCP SYN报文时选择的ISN为真随机数。系统类型为Windows的节点在响应一个TCP SYN报文时选择的ISN是用一个时间相关模型确定的，每过一段时间ISN就被加上一个固定的数等等。因此攻击者可以根据根据节点响应一个TCP连接请求时所选择的ISN来识别系统类型。
另一种方法为，系统类型为AIX的节点发送的TCP报文的TCP窗口大小为0x3F25，系统类型为Windows2000、OpenBSD、FreeBSD的节点发送的TCP报文的TCP窗口大小为0x402E。因此攻击者可以利用这个特征来识别系统类型。
另一种方法为，大多数系统类型的节点上一个关闭的TCP端口在接收到设定了FIN|PSH|URG标志的报文时，会将返回报文的ACK设置为接收到的初始序列数，而系统系统为Windows的节点和一些网络打印机设备会将ACK加1。若系统为Windows的节点上一个开放的TCP端口在接收到设定了FIN|PSH|URG标志的报文时，在某些时候会返回序列号，但也有可能将序列号加1，甚至还可能送回一个随机数。因此攻击者可以利用这个特征来识别系统类型。
除上述几种方法之外，攻击者还可以根据ICMP错误信息、ICMP消息引用，ICMP错误消息回应完整性、服务类型、IP分片重组、TCP选项、SYN Flood限度等等来识别系统类型，或者，还可以根据IP总长度、IP ID字段、IP头校验和、UDP头校验和、优先权字段、DF位响应、IP ID字段、IP TTL字段、TOS字段等等来识别系统类型。
因此，网络安全设备还可以将发送给外部设备的外发报文的报文格式进行调整，从而可以使外部设备根据接收到的报文中能够暴露系统类型的特征字段判断出错误的系统类型。其中，外发报文可以为网络安全设备基于防火墙策略构造的第一报文的响应报文，或者，外发报文可以为受保护网络中的内部设备通过网络安全设备转发的报文。
具体的，网络安全设备可以基于伪装策略将外发报文按照为伪装模板调整报文格式，但是不修改响应报文的载荷。伪装策略包括匹配条件，以及匹配条件对应的动作，即按照伪装模板调整外发报文的报文格式，其中，伪装模板定义了至少一个需要改写的协议字段，在协议字段被改写之后，对报文的载荷没有影响，但是可以使报文暴露出不真实的系统类型。让攻击者无法根据接收到的报文判断内部设备的系统类型时得到错误的结论，从而无法获取内部设备的漏洞。所述需要改写的协议字段可以为ICMP错误信息、ICMP消息引用、ICMP错误消息回应完整性、服务类型、IP分片重组、TCP选项、SYN Flood限度等等可以暴露系统类型的特征字段。
其中，伪装策略中的匹配条件可以根据需要自行设置，如，匹配条件可以为源IP地址为受保护网络中的任一IP地址、源端口号为任一端口号；或者，匹配条件也可以为协 议类型为TCP、源IP地址为受保护网络中的任一IP地址、源端口号为80；或者，匹配条件也可以为其他，本申请实施例在这里不做具体限定。
网络安全设备处理外发报文的过程，如图10所示，具体为：
S1001，网络安全设备将外发报文的五元组信息与伪装策略中的匹配条件进行匹配。
若外发报文的五元组信息与伪装策略中的匹配条件相匹配，则执行步骤S1002。
S1002，网络安全设备按照伪装模板调整外发报文的报文格式，并将调整后的外发报文进行转发。
若外发报文的五元组信息与伪装策略中的匹配条件不匹配，则执行步骤S1003。
S1003，网络安全设备将外发报文进行转发。
以伪装策略中的匹配条件为源端口号为80，协议类型为TCP为例，网络安全设备可以通过如下代码实现伪装策略，在如下代码中在“：”之前的代码为匹配条件，在“：”之后的代码为伪装策略中的动作：
<TCP_Potocal><Any_SourceIP><TCP_Port＝80>—><Any_DestIP><Any_DestPort>:<报文伪装><伪装模板>//针对源端口号为80，协议类型为TCP的外发报文，采用伪装模板中的描述，对该外发报文的协议字段进行改写。
其中，伪装模板可以为某一个系统类型对应的报文格式。
通过伪装策略的方法，攻击者或者普通用户接收到的是对系统类型进行伪装之后的网络报文。由于报文载荷未变，因此普通用户不受影响，但是攻击者无法通过接收到网络报文的协议字段识别受保护网络中的内部设备的系统类型。
基于与方法实施例同样的发明构思，本申请还提供了一种网络安全设备，如图11所示，所述网络安全设备部署于受保护网络和所述外部设备所在的外部网络之间，所述网络安全设备中保存虚假网络的配置信息，所述配置信息中包括所述虚假网络的各个节点的网络协议IP地址，所述网络安全设备包括接收单元1101、匹配单元1102、第一处理单元1103以及第二处理单元1104。其中，接收单元1101，用于接收外部设备发送的第一报文。匹配单元1102，用于将所述接收单元1101接收的所述第一报文的目的IP地址与所述虚假网络的配置信息进行匹配。第一处理单元1103，用于在所述虚假网络的配置信息中的一个节点的IP地址与所述目的IP地址具有相同的子网前缀时，基于虚假网络策略处理所述第一报文，每个所述虚假网络策略包括匹配条件，以及与所述匹配条件对应的动作，所述动作包括构造并发送响应报文，或者禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备。第二处理单元1104，用于在所述虚假网络的配置信息中不存在一个节点的IP地址与所述目的IP地址具有相同的子网前缀时，基于防火墙策略处理所述第一报文。
可选的，所述第一处理单元1103，具体用于确定所述第一报文的匹配信息，并将所述第一报文的匹配信息分别与至少一个所述虚假网络策略中包含的匹配条件进行匹配，选择出与所述第一报文匹配的虚假网络策略，并执行选择出的所述虚假网络策略中的动作。其中，所述匹配信息包括以下至少一项：所述第一报文的协议类型，所述第一报文的目的IP地址，所述第一报文的目的端口号。所述第一报文的匹配信息符合选择出的所述虚假网络策略中的匹配条件；
在一种可能的实现方式中，选择出的所述虚假网络策略中的匹配条件为：协议类型为网络控制报文协议ICMP、目的IP地址是所述虚假网络中的第一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐 设备，其中所述响应报文用于指示所述目的IP地址可达。所述配置信息中还可以包括所述虚假网络的各个节点的拓扑关系，所述响应报文还可以携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在发往所述第一节点过程中所经过的路由节点的个数。
在另一种可能的实现方式中，选择出的所述虚假网络策略中的匹配条件为：协议类型为ICMP、目的IP地址不是所述虚假网络中的任一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述目的IP地址不可达、且所述目的IP地址的子网前缀所对应网关设备的IP地址可达。所述配置信息中还可以包括所述虚假网络的各个节点的拓扑关系，所述响应报文还可以携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在发往所述目的IP地址的子网前缀所对应的网关设备过程中所经过的路由节点的个数。
在另一种可能的实现方式中，选择出的所述虚假网络策略中的匹配条件为：协议类型为传输控制协议TCP、目的端口号是第一集合中的端口号，所述第一集合包括至少一个端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的设备中所述目的端口号对应的端口为开放状态、且所述目的设备的IP地址与所述目的IP地址相同。
在另一种可能的实现方式中，选择出的所述虚假网络策略中的匹配条件为：协议类型为TCP、目的端口号不是第一集合中的端口号，所述第一集合包括至少一个端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的设备中所述目的端口号对应的端口为未开放状态、且所述目的设备的IP地址与所述目的IP地址相同。
在另一种可能的实现方式中，选择出的所述虚假网络策略中的匹配条件为：协议类型为用户数据包协议UDP、目的IP地址是所述虚假网络中的第二节点的IP地址、所述目的端口号不是第二集合中包括的端口号，所述第二集合包括至少一个端口号，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述第二节点中所述目的端口号对应的端口不可达。
在另一种可能的实现方式中，选择出的所述虚假网络策略中的匹配条件为：协议类型为UDP、目的IP地址是所述虚假网络中的第三节点的IP地址、目的端口号为第二集合中包括的端口号，所述第二集合包括至少一个端口号，选择出的所述虚假网络策略中的动作是：禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备。
所述第一处理单元1103在构造并发送响应报文时，可以具体用于构造响应报文，并在延迟预设时长后发送所述响应报文。
在另一种可能的实现方式中，选择出的所述虚假网络策略中的匹配条件为：目的IP地址是所述虚假网络中的第四节点的IP地址，选择出的所述虚假网络策略中的动作是：将所述第一报文重定向到蜜罐设备。
可选的，所述第二处理单元1104，具体用于基于防火墙策略构造第一报文格式的响应报文，并向所述外部设备发送所述第一报文格式的响应报文。所述第一报文格式为第一系统类型对应的报文格式，所述第一系统类型与第一内部设备对应的第二系统类型不一致，所述第一内部设备位于所述受保护网络中，且所述第一内部设备的IP地址与所述目的IP 地址相同。
所述接收单元1101，还可以用于接收第二内部设备发送的第二报文，所述第二内部设备为所述受保护网络中的任一设备。所述网络安全设备还可以包括修改单元1105以及转发单元1106。其中，所述修改单元1105，用于将所述接收单元1101接收的所述第二报文的报文格式修改为第二报文格式，所述第二报文格式对应的第三系统类型与所述第二内部设备对应的第四系统类型不一致。所述转发单元1106，用于将经过所述修改单元1105修改后的第二报文格式的所述第二报文进行转发。
本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能模块可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
其中，集成的模块既可以采用硬件的形式实现时，如图12所示，网络安全设备可以包括处理器1202。上述模块对应的实体的硬件可以为处理器1202。处理器1202，可以是一个中央处理模块(英文：central processing unit，简称CPU)，或者为数字处理模块等等。网络安全设备还可以包括通信接口1201，处理器1202通过通信接口1201收发报文。该装置还包括：存储器1203，用于存储处理器1202执行的程序。存储器1203可以是非易失性存储器，比如硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid-state drive，缩写：SSD)等，还可以是易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)。存储器1203是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
处理器1202用于执行存储器1203存储的程序代码，具体用于执行图3至图10所示实施例所述的方法，本申请在此不再赘述。
本申请实施例中不限定上述通信接口1201、处理器1202以及存储器1203之间的具体连接介质。本申请实施例在图12中以存储器1203、处理器1202以及通信接口1201之间通过总线1204连接，总线在图12中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供了一种计算机可读存储介质，用于存储为执行上述处理器所需执行的计算机软件指令，其包含用于执行上述处理器所需执行的程序。
本申请实施例提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行图3至图10所述的防御网络攻击的方法。
本申请实施例提供一种芯片系统，该芯片系统包括处理器，用于支持网络安全设备实现图3至图10中所述的防御网络攻击的方法中所涉及的功能。在一种可能的设计中，芯片系统还包括存储器，用于保存网络安全设备必要的程序指令和数据。芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序 产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (23)

  1. 一种防御网络攻击的方法，其特征在于，所述方法包括：
    网络安全设备接收外部设备发送的第一报文，所述网络安全设备部署于受保护网络和所述外部设备所在的外部网络之间，所述网络安全设备中保存虚假网络的配置信息，所述配置信息中包括所述虚假网络的各个节点的网络协议IP地址；
    所述网络安全设备将所述第一报文的目的IP地址与所述虚假网络的配置信息进行匹配；
    如果所述虚假网络的配置信息中的一个节点的IP地址与所述目的IP地址具有相同的子网前缀，所述网络安全设备基于虚假网络策略处理所述第一报文，每个所述虚假网络策略包括匹配条件，以及与所述匹配条件对应的动作，所述动作包括构造并发送响应报文，或者禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备；或者，
    如果所述虚假网络的配置信息中不存在一个节点的IP地址与所述目的IP地址具有相同的子网前缀，所述网络安全设备基于防火墙策略处理所述第一报文。
  2. 如权利要求1所述的方法，其特征在于，所述网络安全设备基于虚假网络策略处理所述第一报文，包括：
    所述网络安全设备确定所述第一报文的匹配信息，所述匹配信息包括以下至少一项：所述第一报文的协议类型，所述第一报文的目的IP地址，所述第一报文的目的端口号；
    所述网络安全设备将所述第一报文的匹配信息分别与至少一个所述虚假网络策略中包含的匹配条件进行匹配，选择出与所述第一报文匹配的虚假网络策略，其中所述第一报文的匹配信息符合选择出的所述虚假网络策略中的匹配条件；
    所述网络安全设备执行选择出的所述虚假网络策略中的动作。
  3. 如权利要求2所述的方法，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为网络控制报文协议ICMP、目的IP地址是所述虚假网络中的第一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述目的IP地址可达。
  4. 如权利要求3所述的方法，其特征在于，所述配置信息中还包括所述虚假网络的各个节点的拓扑关系，所述响应报文携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在发往所述第一节点过程中所经过的路由节点的个数。
  5. 如权利要求2所述的方法，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为ICMP、目的IP地址不是所述虚假网络中的任一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述目的IP地址不可达、且所述目的IP地址的子网前缀所对应网关设备的IP地址可达。
  6. 如权利要求5所述的方法，其特征在于，所述配置信息中还包括所述虚假网络的各个节点的拓扑关系，所述响应报文携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在发往所述目的IP地址的子网前缀所对应的网关设备过程中所经过的路由节点的个数。
  7. 如权利要求2所述的方法，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为传输控制协议TCP、目的端口为所述虚假网络中的第一端口，所述目的端口根据目的IP地址以及目的端口号所确定，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的端口为开放状态。
  8. 如权利要求2所述的方法，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为TCP、目的端口不为所述虚假网络中的第一端口，所述目的端口根据目的IP地址以及目的端口号所确定，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的端口为未开放状态。
  9. 如权利要求2所述的方法，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为用户数据包协议UDP、目的端口不为所述虚假网络中的第二端口，所述目的端口根据目的IP地址以及目的端口号所确定，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的端口不可达。
  10. 如权利要求2所述的方法，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为UDP、目的端口为所述虚假网络中的第二端口，所述目的端口根据目的IP地址以及目的端口号所确定，选择出的所述虚假网络策略中的动作是：禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备。
  11. 如权利要求1至9中任一项所述的方法，其特征在于，所述网络安全设备构造并发送响应报文，包括：
    所述网络安全设备构造响应报文，并在延迟预设时长后发送所述响应报文。
  12. 如权利要求2所述的方法，其特征在于，选择出的所述虚假网络策略中的匹配条件为：目的IP地址是所述虚假网络中的第四节点的IP地址，选择出的所述虚假网络策略中的动作是：将所述第一报文重定向到蜜罐设备。
  13. 如权利要求1至12任一项所述的方法，其特征在于，所述网络安全设备基于防火墙策略处理所述第一报文，包括：
    所述网络安全设备基于防火墙策略构造第一报文格式的响应报文，所述第一报文格式为第一系统类型对应的报文格式，所述第一系统类型与第一内部设备对应的第二系统类型不一致，所述第一内部设备位于所述受保护网络中，且所述第一内部设备的IP地址与所述目的IP地址相同；
    所述网络安全设备向所述外部设备发送所述第一报文格式的响应报文。
  14. 如权利要求1至13任一项所述的方法，其特征在于，所述方法还包括：
    所述网络安全设备接收第二内部设备发送的第二报文，所述第二内部设备为所述受保护网络中的任一设备；
    所述网络安全设备将所述第二报文的报文格式修改为第二报文格式，所述第二报文格式对应的第三系统类型与所述第二内部设备对应的第四系统类型不一致；
    所述网络安全设备将第二报文格式的所述第二报文进行转发。
  15. 一种网络安全设备，其特征在于，所述网络安全设备部署于受保护网络和所述外部设备所在的外部网络之间，所述网络安全设备中保存虚假网络的配置信息，所述配置信 息中包括所述虚假网络的各个节点的网络协议IP地址，所述网络安全设备包括：
    接收单元，用于接收外部设备发送的第一报文；
    匹配单元，用于将所述接收单元接收的所述第一报文的目的IP地址与所述虚假网络的配置信息进行匹配；
    第一处理单元，用于在所述虚假网络的配置信息中的一个节点的IP地址与所述目的IP地址具有相同的子网前缀时，基于虚假网络策略处理所述第一报文，每个所述虚假网络策略包括匹配条件，以及与所述匹配条件对应的动作，所述动作包括构造并发送响应报文，或者禁止对所述第一报文进行应答，或者将所述第一报文重定向到蜜罐设备；
    第二处理单元，用于在所述虚假网络的配置信息中不存在一个节点的IP地址与所述目的IP地址具有相同的子网前缀时，基于防火墙策略处理所述第一报文。
  16. 如权利要求15所述的网络安全设备，其特征在于，所述第一处理单元，具体用于：
    确定所述第一报文的匹配信息，所述匹配信息包括以下至少一项：所述第一报文的协议类型，所述第一报文的目的IP地址，所述第一报文的目的端口号；
    将所述第一报文的匹配信息分别与至少一个所述虚假网络策略中包含的匹配条件进行匹配，选择出与所述第一报文匹配的虚假网络策略，其中所述第一报文的匹配信息符合选择出的所述虚假网络策略中的匹配条件；
    执行选择出的所述虚假网络策略中的动作。
  17. 如权利要求16所述的网络安全设备，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为网络控制报文协议ICMP、目的IP地址是所述虚假网络中的第一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述目的IP地址可达。
  18. 如权利要求17所述的网络安全设备，其特征在于，所述配置信息中还包括所述虚假网络的各个节点的拓扑关系，所述响应报文携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在发往所述第一节点过程中所经过的路由节点的个数。
  19. 如权利要求16所述的网络安全设备，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为ICMP、目的IP地址不是所述虚假网络中的任一节点的IP地址，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示所述目的IP地址不可达、且所述目的IP地址的子网前缀所对应网关设备的IP地址可达。
  20. 如权利要求19所述的网络安全设备，其特征在于，所述配置信息中还包括所述虚假网络的各个节点的拓扑关系，所述响应报文携带生存时间，所述生存时间为所述网络安全设备基于所述拓扑关系所确定的，且所述生存时间表示报文在发往所述目的IP地址的子网前缀所对应的网关设备过程中所经过的路由节点的个数。
  21. 如权利要求16所述的网络安全设备，其特征在于，选择出的所述虚假网络策略中的匹配条件为：协议类型为传输控制协议TCP、目的端口为所述虚假网络中的第一端口，所述目的端口根据目的IP地址以及目的端口号所确定，选择出的所述虚假网络策略中的动作是：构造并发送响应报文，或者将所述第一报文重定向到蜜罐设备，其中所述响应报文用于指示目的端口为开放状态。
  22. 如权利要求15至21中任一项所述的网络安全设备，其特征在于，所述第一处理单元在构造并发送响应报文时，具体用于：
    构造响应报文，并在延迟预设时长后发送所述响应报文。
  23. 一种计算机存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行权利要求1至14任一项所述的方法。
PCT/CN2019/078391 2018-03-19 2019-03-16 一种防御网络攻击的方法及装置 WO2019179375A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19770587.4A EP3761589A4 (en) 2018-03-19 2019-03-16 METHOD AND DEVICE FOR DEFENSING NETWORK ATTACKS
US17/026,202 US11570212B2 (en) 2018-03-19 2020-09-19 Method and apparatus for defending against network attack

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810226068.X 2018-03-19
CN201810226068.XA CN110290098B (zh) 2018-03-19 2018-03-19 一种防御网络攻击的方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/026,202 Continuation US11570212B2 (en) 2018-03-19 2020-09-19 Method and apparatus for defending against network attack

Publications (1)

Publication Number Publication Date
WO2019179375A1 true WO2019179375A1 (zh) 2019-09-26

Family

ID=67986730

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/078391 WO2019179375A1 (zh) 2018-03-19 2019-03-16 一种防御网络攻击的方法及装置

Country Status (4)

Country Link
US (1) US11570212B2 (zh)
EP (1) EP3761589A4 (zh)
CN (1) CN110290098B (zh)
WO (1) WO2019179375A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113553590A (zh) * 2021-08-12 2021-10-26 广州锦行网络科技有限公司 一种蜜罐防止攻击者逃逸的方法

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112953882A (zh) * 2019-12-10 2021-06-11 北京网藤科技有限公司 一种动态蜜罐防御系统及其防御方法
CN110995495A (zh) * 2019-12-10 2020-04-10 北京知道创宇信息技术股份有限公司 网络故障检测方法、装置、电子设备及存储介质
CN111556061B (zh) * 2020-04-29 2022-07-12 上海沪景信息科技有限公司 网络伪装方法、装置、设备及计算机可读存储介质
CN113949520B (zh) * 2020-06-29 2024-02-09 奇安信科技集团股份有限公司 欺骗诱捕的方法、装置、计算机设备和可读存储介质
CN112637175B (zh) * 2020-12-17 2021-08-20 山东云天安全技术有限公司 一种用于工业物联网的防御方法及装置
CN112769771A (zh) * 2020-12-24 2021-05-07 中国人民解放军战略支援部队信息工程大学 基于虚假拓扑生成的网络防护方法及系统和系统架构
CN113098895A (zh) * 2021-04-26 2021-07-09 成都中恒星电科技有限公司 一种基于dpdk的网络流量隔离系统
CN115834090A (zh) * 2021-09-15 2023-03-21 华为技术有限公司 通信方法及装置
CN114465747B (zh) * 2021-09-28 2022-10-11 北京卫达信息技术有限公司 基于动态端口伪装的主动欺骗防御方法及系统
CN114710307B (zh) * 2021-09-28 2022-11-29 北京卫达信息技术有限公司 一种基于虚拟网络的网络探测识别方法及系统
CN114500086B (zh) * 2022-02-22 2022-11-04 山东云天安全技术有限公司 蜜罐安全状态确定方法、电子设备和计算机可读存储介质
CN114500118B (zh) * 2022-04-15 2022-07-01 远江盛邦（北京）网络安全科技股份有限公司 卫星网络拓扑的隐藏方法及装置
CN115987681B (zh) * 2023-01-09 2024-06-14 中国人民解放军国防科技大学 关键拓扑信息混淆方法、装置、计算机设备和存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006107712A2 (en) * 2005-04-04 2006-10-12 Bae Systems Information And Electronic Systems Integration Inc. Method and apparatus for defending against zero-day worm-based attacks
CN101087196A (zh) * 2006-12-27 2007-12-12 北京大学 多层次蜜网数据传输方法及系统
CN101567887A (zh) * 2008-12-25 2009-10-28 中国人民解放军总参谋部第五十四研究所 一种漏洞拟真超载蜜罐方法
CN103607399A (zh) * 2013-11-25 2014-02-26 中国人民解放军理工大学 基于暗网的专用ip网络安全监测系统及方法
CN105721442A (zh) * 2016-01-22 2016-06-29 耿童童 基于动态变换虚假响应系统、方法及网络安全系统与方法
US20170331858A1 (en) * 2016-05-10 2017-11-16 Quadrant Information Security Method, system, and apparatus to identify and study advanced threat tactics, techniques and procedures

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002098100A1 (en) 2001-05-31 2002-12-05 Preventon Technologies Limited Access control systems
US7257837B2 (en) * 2003-07-26 2007-08-14 Innomedia Pte Firewall penetration system and method for real time media communications
US9578055B1 (en) * 2008-01-25 2017-02-21 F5 Networks, Inc. Thwarting drone-waged denial of service attacks on a network
US8181250B2 (en) * 2008-06-30 2012-05-15 Microsoft Corporation Personalized honeypot for detecting information leaks and security breaches
CN101582907B (zh) 2009-06-24 2012-07-04 成都市华为赛门铁克科技有限公司 一种增强蜜网诱骗力度的方法和蜜网系统
CN101873556B (zh) 2010-06-24 2013-05-22 北京安天电子设备有限公司 一种针对通信网络恶意信息的蜜罐捕获系统
US8955128B1 (en) * 2011-07-27 2015-02-10 Francesco Trama Systems and methods for selectively regulating network traffic
CN103561004B (zh) 2013-10-22 2016-10-12 西安交通大学 基于蜜网的协同式主动防御系统
US9716727B1 (en) * 2014-09-30 2017-07-25 Palo Alto Networks, Inc. Generating a honey network configuration to emulate a target network environment
CN104506507B (zh) 2014-12-15 2017-10-10 蓝盾信息安全技术股份有限公司 一种sdn网络的蜜网安全防护系统及方法
CN106970939B (zh) * 2017-02-14 2019-09-03 深圳昂楷科技有限公司 一种数据库审计方法及其系统
CN106961442A (zh) 2017-04-20 2017-07-18 中国电子技术标准化研究院 一种基于蜜罐的网络诱捕方法
CN107360182B (zh) * 2017-08-04 2020-05-01 南京翼辉信息技术有限公司 一种用于嵌入式的主动网络防御系统及其防御方法
CN107563197A (zh) * 2017-08-30 2018-01-09 杭州安恒信息技术有限公司 一种针对数据库层的拖库撞库攻击防御方法
CN107682342B (zh) * 2017-10-17 2020-03-10 盛科网络（苏州）有限公司 一种基于openflow的DDoS流量牵引的方法和系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006107712A2 (en) * 2005-04-04 2006-10-12 Bae Systems Information And Electronic Systems Integration Inc. Method and apparatus for defending against zero-day worm-based attacks
CN101087196A (zh) * 2006-12-27 2007-12-12 北京大学 多层次蜜网数据传输方法及系统
CN101567887A (zh) * 2008-12-25 2009-10-28 中国人民解放军总参谋部第五十四研究所 一种漏洞拟真超载蜜罐方法
CN103607399A (zh) * 2013-11-25 2014-02-26 中国人民解放军理工大学 基于暗网的专用ip网络安全监测系统及方法
CN105721442A (zh) * 2016-01-22 2016-06-29 耿童童 基于动态变换虚假响应系统、方法及网络安全系统与方法
US20170331858A1 (en) * 2016-05-10 2017-11-16 Quadrant Information Security Method, system, and apparatus to identify and study advanced threat tactics, techniques and procedures

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113553590A (zh) * 2021-08-12 2021-10-26 广州锦行网络科技有限公司 一种蜜罐防止攻击者逃逸的方法
CN113553590B (zh) * 2021-08-12 2022-03-29 广州锦行网络科技有限公司 一种蜜罐防止攻击者逃逸的方法

Also Published As

Publication number Publication date
CN110290098A (zh) 2019-09-27
EP3761589A4 (en) 2021-05-05
US20210006594A1 (en) 2021-01-07
US11570212B2 (en) 2023-01-31
CN110290098B (zh) 2020-12-25
EP3761589A1 (en) 2021-01-06

Similar Documents

Publication Publication Date Title
WO2019179375A1 (zh) 一种防御网络攻击的方法及装置
Ambrosin et al. Lineswitch: Efficiently managing switch flow in software-defined networking while effectively tackling dos attacks
WO2021032207A1 (zh) 网络威胁的诱捕方法、系统和转发设备
US7356689B2 (en) Method and apparatus for tracing packets in a communications network
Qian et al. Off-path TCP sequence number inference attack-how firewall middleboxes reduce security
Long et al. Trends in denial of service attack technology
US8423645B2 (en) Detection of grid participation in a DDoS attack
KR101010465B1 (ko) 엔드포인트 리소스를 사용하는 네트워크 보안 요소
CN110071929B (zh) 一种基于虚拟化平台的海量诱饵捕获攻击源的防御方法
US20140157405A1 (en) Cyber Behavior Analysis and Detection Method, System and Architecture
JP2002026907A (ja) 通信ネットワークセキュリティ方法および通信ネットワークのネットワークセキュリティを分析するための方法および通信システムおよびセキュリティホストコンピュータおよび機械で読み出し可能な媒体。
Grigoryan et al. Lamp: Prompt layer 7 attack mitigation with programmable data planes
Trabelsi et al. Denial of firewalling attacks (dof): The case study of the emerging blacknurse attack
Nagesh et al. A survey on denial of service attacks and preclusions
Ghorbani et al. Network attacks
Chen et al. An inline detection and prevention framework for distributed denial of service attacks
Dodia et al. Poster: SDN-based system to filter out DRDoS amplification traffic in ISP networks
Zhong et al. Research on DDoS Attacks in IPv6
US20050147037A1 (en) Scan detection
Selvaraj Distributed Denial of Service Attack Detection, Prevention and Mitigation Service on Cloud Environment
Abdelhafez et al. Evaluation of worm containment algorithms and their effect on legitimate traffic
Naidu et al. IPv6: threats posed by multicast packets, extension headers and their counter measures
Nagaonkar et al. Detecting stealthy scans and scanning patterns using threshold random walk
Singhal et al. Design and Development of Anti-DoS/DDoS Attacks Framework Using IPtables
Daniels et al. Subliminal traceroute in TCP/IP

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19770587

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019770587

Country of ref document: EP

Effective date: 20200928