WO2021032207A1 - 网络威胁的诱捕方法、系统和转发设备 - Google Patents

网络威胁的诱捕方法、系统和转发设备 Download PDF

Info

Publication number
WO2021032207A1
WO2021032207A1 PCT/CN2020/110656 CN2020110656W WO2021032207A1 WO 2021032207 A1 WO2021032207 A1 WO 2021032207A1 CN 2020110656 W CN2020110656 W CN 2020110656W WO 2021032207 A1 WO2021032207 A1 WO 2021032207A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
packet
forwarding device
message
trapping
Prior art date
Application number
PCT/CN2020/110656
Other languages
English (en)
French (fr)
Inventor
杨华志
王东辉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20855435.2A priority Critical patent/EP3923551A4/en
Publication of WO2021032207A1 publication Critical patent/WO2021032207A1/zh
Priority to US17/369,057 priority patent/US20210344714A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/66—Layer 2 routing, e.g. in Ethernet based MAN's
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H04L61/2528—Translation at a proxy

Definitions

  • This application relates to the technical field of computer network security, and in particular to a method, device, system and forwarding device for trapping network threats.
  • malware such as worms, viruses, etc.
  • attackers use social engineering methods to conduct attacks, and use the internal of a company, school, or government. Attacks realized by multiple jumps between multiple hosts in the network.
  • Honeypot is a technology to deceive the attacker.
  • a honeypot deploys one or a group of computers as bait. Some network services are turned on on the computer or pretend to store high-value data to attract hacker attacks.
  • the honeypot may also be equipped with monitoring software to monitor and capture the behavior of malicious software or hacker intrusion as a honeypot for the researcher to analyze or crack.
  • the honeypot can be realized through a separate server, virtual machine, or through software.
  • a typical trapping system logically consists of one or more honeypots, a honeypot management server for managing the honeypots, and one or more agents.
  • One or more honeypots can be implemented by virtual machines.
  • the honeypot management server is used to manage one or more honeypots and to provide agents with interfaces for using honeypot services.
  • the honeypot and the honeypot management server can be implemented by the same computer.
  • the agent is usually implemented by a software program. The agent runs on multiple hosts in the internal network and is used to send all the messages that access the host where the agent is located or the messages that access the designated port of the host where the agent is located to the honeypot management server.
  • the embodiment of the present application provides a cyber threat trapping method to reduce the deployment cost of the existing trapping system.
  • a network trapping method In the first aspect, a network trapping method is provided.
  • the forwarding device obtains a trapping target set, the trapping target set includes at least one trapping target, and the at least one trapping target includes an unused Internet Protocol (IP) address or a used IP address Port number that is not open on the Internet.
  • IP Internet Protocol
  • the forwarding device receives the first IP packet from the first host, and the forwarding device determines whether the destination to which the first IP packet requests access belongs to the trap target set. If the destination to which the first IP packet requests access belongs to the trap target set, the forwarding device sends the first IP packet to the honeypot management server.
  • the forwarding device receives a second IP packet returned by the honeypot management server, where the second IP packet is a response packet of the first IP packet, and sends the first IP packet to the first host 2. IP packets.
  • the forwarding device is based on the actual network environment and uses unused addresses or port numbers in the subnet to which the forwarding device is connected to simulate a large number of honeypots.
  • the trapping point is realized on the forwarding device.
  • the forwarding device acts as a trapping point for the trapping solution.
  • a host a host potentially controlled by hackers or malware
  • the forwarding device creates a trapping target set. Thereafter, the forwarding device sends the message requesting access to the trapping target to the honeypot management server, and sends the corresponding return message from the honeypot server to the initiator of the above request.
  • the host that initiates the access can subsequently communicate normally with the simulated destination requesting access, and the forwarding device deceives the initiator to believe that there is a destination requesting access in the network, and can subsequently communicate with the destination requesting access. Perform normal communication. Since the number of forwarding devices in the internal network is usually much smaller than the number of hosts, and the threat capture solution provided by this application does not require the installation of a software program that implements proxy functions on the hosts in the internal network, unlike the threat trapping that implements drainage on a single real host Compared with the scheme, the cost of deployment and maintenance of the trapping system is reduced.
  • the forwarding device uses one or a combination of multiple methods to obtain the aforementioned trapping target set.
  • the forwarding device obtains an unused IP address during the address resolution protocol (ARP) request processing process, and adds the unused IP address as a trap target to the trap target set.
  • the forwarding device receives a first ARP message, where the first ARP message is an ARP request message.
  • the forwarding device determines the online status of the destination IP address of the first ARP packet according to the IP address status table, and the IP address status table is used to indicate that multiple IP addresses in the subnet range to which the forwarding device is connected correspond to each other
  • the online status is online or offline. If the online status of the destination IP address of the first ARP packet is offline, the destination IP address of the first ARP request packet is added to the trap target set as an unused IP address.
  • the trapping target set obtained by the forwarding device in the process of ARP request processing is used for the forwarding device to send IP packets belonging to the trapping target set to the honeypot management server when the forwarding device subsequently receives IP packets, and the honeypot
  • the message returned by the management server is sent to the host that sent the above IP message, so as to realize the function of the diversion point.
  • the method further includes: the forwarding device converts the first ARP packet in the IP address state table The online status corresponding to the source IP address of the message is set to online.
  • the unused IP addresses in the trap target set may be subsequently assigned to hosts in the internal network for use.
  • the trapping target set is updated in a timely manner to prevent the IP-related packets from being used as trapping objects to be forwarded to the honeypot associated server.
  • the method further includes: the forwarding device receives a second ARP message, where the second ARP message is an ARP response message or a gratuitous ARP message Text. The forwarding device judges whether the source IP address of the second ARP packet is included in the trap target set. If the trap target set contains the source IP address of the second ARP packet, delete the source IP address of the second ARP packet as an unused IP address from the trap target set.
  • the forwarding device may also update the IP address state table after receiving the second ARP message.
  • the method further includes: the forwarding device converts the source of the second ARP packet in the IP address state table The online status corresponding to the IP address is set to online. In this way, the forwarding device can update the IP address status table in a timely manner.
  • the forwarding device obtains an unused IP address during the processing of the IP packet, and adds the unused IP address as a trap target to the trap target set.
  • the forwarding device adds the trapping target to the trapping target set at multiple times such as querying the routing table and querying the ARP table during the IP packet forwarding process.
  • obtaining the trapping target in the process of querying the routing table includes: a forwarding device receives a third IP packet, and according to the destination IP address of the third IP packet, querying the routing table of the forwarding device for the The next hop IP address corresponding to the third IP packet. If the next hop IP address corresponding to the third IP packet does not exist in the routing table, the forwarding device adds the destination IP address of the third IP packet as an unused IP address to the trap target set .
  • the forwarding device determines that the destination of the third IP packet is the trapping target during the process of querying the routing table, the forwarding device sends the third IP packet to the honeypot management server so as to respond to the third IP packet. Entrapment is performed in order to achieve the purpose of deceiving the sender of the third IP packet.
  • the forwarding device sends the third IP message to the honeypot management server, receives a response message for the third IP message from the honeypot management server, and forwards the response message.
  • the forwarding device obtains the trapping target in the process of querying the ARP table includes: if the next hop IP address corresponding to the third IP packet exists in the routing table, then the forwarding device queries the ARP table The media access control (MAC) address corresponding to the next hop IP address. If the MAC address corresponding to the next hop IP address does not exist in the ARP table, the forwarding device determines the online status of the destination IP of the third IP packet according to the IP address status table, and the IP address The status table is used to indicate the online statuses respectively corresponding to multiple IP addresses within at least one subnet range to which the forwarding device is connected, and the online status is online or offline.
  • MAC media access control
  • the forwarding device will send the third IP The destination IP address of the message is added to the trapping target set as an unused IP address.
  • the forwarding device determines that the destination of the third IP packet is the trapping target, the forwarding device sends the third IP packet to the honeypot management server so as to respond to the third IP packet. Entrapment is performed in order to achieve the purpose of deceiving the sender of the third IP packet.
  • the forwarding device sends the third IP message to the honeypot management server, receives a response message for the third IP message from the honeypot management server, and forwards the response message.
  • the trapping target set obtained by the forwarding device in the process of IP packet processing is used for the forwarding device to send IP packets belonging to the trapping target set to the honeypot management server when the forwarding device subsequently receives the IP packet
  • the message returned by the tank management server is sent to the host that sent the above IP message, so as to realize the function of the diversion point.
  • the forwarding device not only determines the trapping target taking the unused IP address as an example during the processing of the above-mentioned ARP request and IP message to obtain the trapping target set, but also can process the first predetermined type (connection reset (RST) In the process of the IP message of) message), a trapping target taking an unused port number on the used IP address as an example is obtained to obtain a trapping target set. Therefore, in another possible implementation manner of the first aspect, the forwarding device receives a fourth IP packet, and the fourth IP packet is an RST packet.
  • RST connection reset
  • the forwarding device determines whether the fourth IP packet meets a trapping condition, and the trapping condition includes: before receiving the fourth IP packet, at least one connection establishment (SYN) packet corresponding to the fourth IP packet is received.
  • SYN connection establishment
  • the destination IP address of the SYN packet corresponding to the fourth IP packet is the same as the source IP address of the fourth IP packet, and the destination port number is the same as the source port number of the fourth IP packet. If the fourth IP packet satisfies the trapping condition, the forwarding device uses the source IP address of the fourth IP packet as the used IP address and the source port number of the fourth IP packet as the all The unopened port number on the IP address indicated by the source IP address of the fourth IP packet is added to the trap target set.
  • the trapping condition includes: determining whether the fourth IP packet meets the trapping condition, and the trapping condition includes: a predetermined period of time before the fourth IP packet is received At least one SYN message corresponding to the fourth IP message is received before, and other messages that have the same source IP address and source port number as the fourth IP message received within the predetermined time period
  • the messages are all RST messages, the destination IP address of the SYN message corresponding to the fourth IP message is the same as the source IP address of the fourth IP message, and the destination port number is the same as that of the fourth IP message.
  • the source port number is the same.
  • the forwarding device uses the source IP address of the fourth IP packet as the used IP address and the source port number of the fourth IP packet as the all The unopened port number on the IP address indicated by the source IP address of the fourth IP packet is added to the trap target set.
  • the forwarding device receives a fourth IP packet, and the fourth IP packet is an ICMP unreachable packet.
  • the trapping condition includes: before receiving the fourth IP packet, at least one UDP packet corresponding to the fourth IP packet is received, and the first The destination IP address of the UDP packet corresponding to the fourth IP packet is the same as the source IP address of the fourth IP packet, and the destination port number is the same as the source port number of the fourth IP packet. If the fourth IP packet satisfies the trapping condition, the forwarding device uses the source IP address of the fourth IP packet as the used IP address and the source port number of the fourth IP packet as the all The unopened port number on the IP address indicated by the source IP address of the fourth IP packet is added to the trap target set.
  • the trapping condition includes: determining whether the fourth IP packet meets the trapping condition, and the trapping condition includes: a predetermined period of time before the fourth IP packet is received At least one UDP packet corresponding to the fourth IP packet is received before, and other packets that have the same source IP address and source port number as the fourth IP packet received within the predetermined time period
  • the messages are all ICMP unreachable messages, the destination IP address of the UDP message corresponding to the fourth IP message is the same as the source IP address of the fourth IP message, and the destination port number is the same as that of the fourth IP message.
  • the source port number of the text is the same. If the fourth IP packet satisfies the trapping condition, the forwarding device uses the source IP address of the fourth IP packet as the used IP address and the source port number of the fourth IP packet as the all The unopened port number on the IP address indicated by the source IP address of the fourth IP packet is added to the trap target set.
  • the forwarding device determines that the destination of the fourth IP packet is the trapping target, Then the forwarding device sends the fourth IP packet to the honeypot management server to trap the fourth IP packet, so as to achieve the purpose of deceiving the sender of the fourth IP packet.
  • the forwarding device sends the fourth IP message to the honeypot management server, receives a response message for the fourth IP message from the honeypot management server, and forwards the response message.
  • the above-mentioned methods for obtaining trapping targets can be used alone or in combination, for example, the second and third methods for obtaining trapping targets can be combined use.
  • the fourth IP packet is an RST packet
  • the forwarding device processes the fourth IP packet in the third manner
  • if the fourth IP packet does not meet the trapping condition it continues to process the fourth IP packet in the second manner.
  • the method further includes: according to the destination IP address of the fourth IP packet, the forwarding device queries the routing table of the forwarding device for the first Four IP address of the next hop corresponding to the IP packet. If the next hop IP address corresponding to the fourth IP packet does not exist in the routing table, the destination IP address of the fourth IP packet is added to the trapping target set as an unused IP address.
  • the method further includes: sending the fourth IP packet to the honeypot management server.
  • the forwarding device receives the response message of the fourth IP message from the honeypot management server, and forwards the response message of the fourth IP message to the first host.
  • the forwarding device determines the online status of the destination IP of the fourth IP packet according to the IP address status table. If the MAC address corresponding to the next-hop IP address does not exist in the ARP table, and the online status of the destination IP address of the fourth IP packet is offline, the forwarding device sets the fourth IP The destination IP address of the message is added to the trapping target set as an unused IP address.
  • the method further includes: forwarding the device to the The honeypot management server sends the fourth IP message. Receiving a response message for the fourth IP packet from the honeypot management server, and forwarding the response message for the fourth IP packet to the first host.
  • the trapping target set obtained by the forwarding device in the RST packet processing process is used to send the IP packets of the destination party belonging to the trapping target set to the honeypot management server when the forwarding device subsequently receives the IP packet, and the honey
  • the message returned by the tank management server is sent to the host that sent the above IP message, so as to realize the function of the diversion point.
  • the forwarding device confirms whether to delete according to the source address information of the fourth IP packet
  • the trapping target in the trapping target set is so as to achieve the purpose of updating the trapping target set.
  • the above method further includes: the forwarding device receives a fourth IP packet, where the fourth IP packet is a SYN-ACK packet.
  • the forwarding device judges whether the trapping target to be deleted is included in the trapping target set, and the trapping target to be deleted is an unopened port number on the used IP address, and the used IP address is the fourth IP packet
  • the source IP address of and the unopened port number are the port numbers indicated by the source port number of the fourth IP packet. If the trapping target to be deleted is included in the trapping target set, the forwarding device deletes the trapping target to be deleted from the trapping target set.
  • the forwarding device updates the trapping target set according to the source address information of the fourth IP packet After that, it is still possible to determine whether the destination of the SYN-ACK message is the trap target according to the second method of obtaining the trap target.
  • the method further includes: the forwarding device performs the following steps according to the destination IP address of the fourth IP packet The routing table of the forwarding device is queried for the next hop IP address corresponding to the fourth IP packet. If the next hop IP address corresponding to the fourth IP packet does not exist in the routing table, the destination IP address of the fourth IP packet is added to the trapping target set as an unused IP address.
  • the method further includes: The honeypot management server sends the fourth IP packet. Receiving the response message of the fourth IP message from the honeypot management server, and forwarding the response message of the fourth IP message to the first host. If the next hop IP address corresponding to the fourth IP packet exists in the routing table, the MAC address corresponding to the next hop IP address is queried in the ARP table.
  • the forwarding device determines the online status of the destination IP of the fourth IP packet according to the IP address status table, and the IP address status table It is used to indicate the online statuses respectively corresponding to multiple IP addresses within the range of at least one subnet to which the forwarding device is connected, and the online status is online or offline. If the MAC address corresponding to the next-hop IP address does not exist in the ARP table, and the online status of the destination IP address of the fourth IP packet is offline, the forwarding device sets the fourth IP The destination IP address of the message is added to the trapping target set as an unused IP address.
  • the forwarding device determines that the destination of the fourth IP packet is trapping during the process of processing the fourth IP packet in the second manner Target, the forwarding device sends a fourth IP packet to the honeypot management server to trap the fourth IP packet, so as to achieve the purpose of deceiving the sender of the fourth IP packet. That is, if the MAC address corresponding to the next-hop IP address does not exist in the ARP table, and the online status of the destination IP address of the fourth IP packet is offline, the forwarding device sends the honeypot management server Sending the fourth IP message, receiving a response message for the fourth IP message from the honeypot management server, and forwarding the response message.
  • the aforementioned forwarding device updates the trapping target set during the processing of the SYN-ACK message, which can improve the accuracy of subsequent IP packet trapping based on the trapping target set, and prevent the IP address in the original trapping target set from being allocated to a host for use. , Affecting the normal communication of the host.
  • the forwarding device uses ARP detection to determine the respective online status of each IP address in the subnet access, thereby forming an IP address status table. That is, the forwarding device respectively sends an ARP request message for each of the multiple IP addresses in the subnet range to which the forwarding device is connected. The forwarding device does not receive the ARP response message for the first IP address, and adds the first IP address to the IP address status table, where the first IP address is an IP address among the multiple IP addresses ; And set the status of the first IP address to offline.
  • the forwarding device receives an ARP response message for a second IP address, where the second IP address is an IP address among the multiple IP addresses; adding the second IP address to the IP address status table; And set the status of the second IP address to online. In this way, the forwarding device can maintain an IP address state table, so as to determine the capture target set based on the IP address state table.
  • the forwarding device forwards the domain name system (Domain Name System, DNS) domain name request.
  • DNS Domain Name System
  • the forwarding device intercepts and stops forwarding a first DNS response message, the first DNS response message is a response message for the DNS domain name request, and the first response message indicates that the DNS domain name request is queried The domain name does not exist.
  • the forwarding device generates a second DNS response message, the second DNS response message includes an IP address corresponding to the domain name queried in the DNS domain name request, and the IP address corresponding to the domain name is a set of trap targets An unused IP address.
  • the forwarding device sends the second DNS response message.
  • the forwarding device traps the DNS detection behavior of potential attackers, which helps to achieve a better trapping effect.
  • the trapping target set is represented as a trapping target table, and the trapping target table includes at least one entry, and the at least Each entry in an entry is used to indicate one of the trapping targets, and each entry includes an IP address to indicate an unused IP address, or a combination of an IP address and port number to indicate The unopened port number on the used IP address.
  • the forwarding device determines whether the destination to which the first IP packet requests access belongs to a trap target set, including: the forwarding device determines whether there is an entry in the trap target table including the destination IP of the first IP packet Address, or a combination including the destination IP address and destination port number of the first IP packet.
  • the forwarding device saves the trapping target set in the form of a trapping target table, which helps to determine whether the destination of the IP packet requesting access belongs to the trapping target set based on the trapping target table after receiving the IP message subsequently, thereby improving the capture efficiency.
  • a cyber threat trapping device in a second aspect, has the function of implementing the method described in the foregoing first aspect or any one of the foregoing first aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • a forwarding device in a third aspect, includes a network interface and at least one processor.
  • the network interface is used to receive or send messages.
  • the at least one processor is connected to the network interface, and executes the foregoing first aspect or any one of the possible implementation methods of the first aspect. For details, refer to the above detailed description, and details are not repeated here.
  • a network threat trapping system which includes a honeypot management server and at least one forwarding device.
  • Each of the at least one forwarding device executes the foregoing first aspect or any one of the possible implementation methods of the first aspect. For details, refer to the foregoing detailed description, and details are not repeated here.
  • a computer-readable storage medium for storing computer software instructions used by the aforementioned forwarding device, and when it runs on a computer, the computer executes the first aspect or any one of the first aspects.
  • a computer program product containing instructions which when run on a computer, causes the computer to execute the method described in the first aspect or any one of the possible implementations of the first aspect.
  • an embodiment of the present application provides a chip, including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the first aspect and its first The method in any possible implementation of the aspect.
  • FIG. 1 is a schematic diagram of an application scenario of a network threat trapping system provided by an embodiment of the present application
  • FIG. 2 is a schematic flow chart of the method for trapping threats provided by an embodiment of the application
  • 3A is a flowchart of a method for creating a trapping target set provided by an embodiment of the application
  • 3B is a flowchart of a method for obtaining an IP address status table provided by an embodiment of the application
  • FIG. 4 is a flowchart of another method for creating a trapping target set provided by an embodiment of the application
  • FIG. 5 is a flowchart of another method for creating a trapping target set according to an embodiment of the application
  • FIG. 6 is a flowchart of a solution for trapping in the process of DNS resolution provided by an embodiment of the application
  • FIG. 7 is a schematic structural diagram of a forwarding device provided by an embodiment of this application.
  • FIG. 8 is a schematic structural diagram of a network threat trapping device provided by an embodiment of this application.
  • Some trapping systems need to install software programs to implement proxy functions on hosts in the internal network.
  • the agent acts as the diversion point of the honeypot, and sends the packets that access the designated port of the host to which the agent belongs to the honeypot management server.
  • the trapping effect that honeypots can achieve is limited.
  • the deployment and maintenance costs of installing software programs on a large number of hosts are high.
  • the embodiment of the application provides a network threat trapping system, which includes a forwarding device and a honeypot management server. Compared with the prior art, the system has important improvements in terms of trapping objects and drainage points.
  • the forwarding device in the internal network (referred to as “forwarding device” for brevity in the subsequent embodiments) is first based on the actual network environment, using unused addresses or unopened ports in the internal network to simulate a large number of Honeypot (here, "honeypot” means non-existent and requested destination address resources).
  • the forwarding device implements a drainage point, that is, the forwarding device sends the message requesting access to the simulated honeypot to the honeypot management server, and sends the corresponding IP message returned by the honeypot server to the initiator of the above request , So as to realize the process of capturing cyber threats. Since the number of forwarding devices in the internal network is usually much smaller than the number of hosts, and the threat capture solution provided by this application does not require the installation of a software program that implements proxy functions on the hosts in the internal network, unlike the threat trapping that implements drainage on a single real host Compared with the scheme, the cost of deployment and maintenance of the trapping system is reduced.
  • Fig. 1 is a schematic diagram of an application scenario of a network threat trapping system provided by an embodiment of the present application.
  • the cyber threat trapping system is applied to the internal network.
  • the internal network includes a local area network of an organization such as a company, a school, and a government department, or multiple local area networks connected through a virtual private network (Virtual Private Network, VPN) within an organization.
  • the internal network includes multiple hosts, such as the host 101 and the host 102, a honeypot server 120, and at least one forwarding device, such as the forwarding device 110 and the forwarding device 111.
  • the host 101 and the host 102 in FIG. 1 may be personal computers, laptop computers, and so on.
  • the IP address of the host 101 is 1.1.1.101
  • the IP address of the host 102 is 1.1.1.102
  • the host 101 and the host 102 belong to the same subnet 1.1.1.1-1.1.1.255.
  • the host 101 and the host 102 are connected through the forwarding device 110.
  • the forwarding device 110 is a layer 3 switch.
  • the three-layer switch is a switch with the third layer (network layer) routing function and the second layer (data link layer) switching function.
  • the Layer 3 switch forwards Layer 2 traffic based on the MAC table.
  • the Layer 3 switch implements "checking the table once (routing table), forwarding multiple times" for Layer 3 traffic based on the routing table.
  • the Layer 3 switch After the Layer 3 switch performs Layer 3 routing for the first data packet between two hosts from different subnets based on the IP address, it obtains the MAC address of the destination host through the ARP learning mechanism, and generates a MAC address and IP address
  • the mapping relationship is stored in an address resolution protocol (Address Resolution Protocol, ARP) table.
  • ARP Address Resolution Protocol
  • the forwarding device 110 may also be a router or a gateway device, which is not specifically limited here.
  • the forwarding device 110 is connected to at least one subnet. If the host 101 and the host 102 belong to the same subnet, the packets between the host 101 and the host 102 can be exchanged at Layer 2. If the host 101 and the host 102 belong to different subnets, the packets between the two need to be forwarded through Layer 3 routing.
  • a tunnel is established between the forwarding device 110 and the honeypot server 120, such as a User Datagram Protocol (UDP) tunnel, a Virtual eXtensible LAN (VXLAN) tunnel, and Generic Routing (Generic Routing). Encapsulation, GRE) tunnel, etc.
  • UDP User Datagram Protocol
  • VXLAN Virtual eXtensible LAN
  • GRE Generic Routing
  • Encapsulation, GRE GRE
  • the forwarding device 110 uses tunnel encapsulation to send the message sent by the requester and whose destination is the capture target to the honeypot management server.
  • the forwarding device 110 receives the message returned by the honeypot management server through the tunnel, and responds to the received message.
  • the message is decapsulated to obtain the encapsulated honeypot host response message, and the decapsulated message is sent to the requester.
  • the forwarding device 110 and the honeypot server 120 cooperate, so that the honeypot host can simulate the capture target to interact with the requester of the message.
  • the honeypot management server 120 is used to manage one or more honeypots (honeypot hosts) and provide honeypot service customers with interfaces for using the honeypot service.
  • the honeypot management server 120 is also used to manage honeypot services.
  • the honeypot management server 120 manages at least one honeypot host.
  • the honeypot management server 120 manages multiple honeypot hosts, which can back up each other and achieve load balancing .
  • FIG. 1 is an example.
  • the honeypot management server 120 manages three honeypot hosts, namely, the honeypot host 1, the honeypot host 2, and the honeypot host 3.
  • three honeypot hosts are implemented by multiple virtual machines respectively.
  • Each honeypot host has a corresponding IP address.
  • the IP address of honeypot host 1 is 172.1.1.1
  • the IP address of honeypot host 2 is 172.1.1.2
  • the IP address of honeypot host 3 is 172.1.1.3.
  • the honeypot management server 120 maps the destination IP address and destination port number of the message received through the tunnel (that is, the inner message encapsulated in the tunnel message) to one of the three honeypot hosts according to a predetermined algorithm Host; perform the first replacement according to the mapping result, that is, replace the destination IP address and destination port number of the message received through the tunnel with the IP address of the mapped honeypot host and the port number of the mapped honeypot host; and the replacement will be generated
  • the message is sent to the mapped honeypot host.
  • the capture target includes the unused IP address 1.1.1.105 in the subnet of the internal network.
  • the forwarding device 110 sends the message (denoted as message 1) with the port number 80 on the IP address 1.1.1.105 accessed by the host 101 to the honeypot server through the tunnel encapsulation.
  • the honeypot server is mapped to honeypot host 1 according to the port number 80.
  • the honeypot management server replaces the destination IP address of message 1 with the IP address of honeypot host 1 being 172.1.1.1, and the destination port number is still 80, thereby generating message 1'.
  • the honeypot management server sends the message 1'generated by the replacement to the honeypot host 1.
  • the honeypot server 120 only replaces the destination IP address of the message received through the tunnel as an example.
  • the honeypot server 120 can also replace both the destination IP address and port number of the message received through the tunnel. The principle is basically similar to that of only replacing the destination IP address, and will not be described with examples here.
  • the honeypot management server 120 receives the message returned by the honeypot host, it performs a second replacement according to the mapping result, that is, replaces the source IP address and source port number of the message returned by the honeypot host with the first Replace the destination IP address and destination port number of the packet received by the tunnel at one time. And send the message generated by the second replacement to the forwarding device through the tunnel.
  • the honeypot management server 120 receives the message (denoted as message 2) returned by the honeypot host 1 for message 1, replaces the source IP address of message 2 with 1.1.1.105, and the source port number is still 80. The message 2'generated by the replacement is sent to the forwarding device 110 through the tunnel.
  • mapping and replacement functions can be performed centrally on the honeypot management server as described above, or can be performed in a distributed manner by multiple forwarding devices. That is, the foregoing functions of mapping the destination address and destination port number of message 1, and performing address and port number replacement for message 1 and message 2 according to the mapping result can also be performed by the forwarding device. Specifically, after the forwarding device 110 replaces the message 1, it sends the message 1'generated by the replacement to the honeypot management server through the tunnel, and performs the address and port replacement for the message 2 sent by the honeypot server through the tunnel. The message 2'generated by the replacement is sent to the host 101.
  • the honeypot management server may simultaneously establish tunnels with multiple forwarding devices and provide honeypot services, it is more advantageous for the honeypot management server to centrally perform the above mapping and replacement functions.
  • This facilitates the centralized implementation of honeypot management services, such as increasing or reducing the number of honeypot hosts, and updating the algorithm used to map the destination IP address and destination port number of the message to one of the honeypot hosts, and so on.
  • the way in which multiple forwarding devices perform the above-mentioned mapping and replacement functions in a distributed manner can prevent the honeypot management server from becoming a performance bottleneck. Therefore, the centralized and distributed implementation of the mapping and replacement functions have their own advantages, and network managers can selectively implement them according to the actual situation.
  • Fig. 2 is a principle flow chart of the threat trapping method provided by the embodiment of the present application.
  • Fig. 2 mainly illustrates the network threat trapping method provided by the embodiment of the present application from the perspective of the forwarding device.
  • the forwarding device in FIG. 2 may be the forwarding device 110 in FIG. 1.
  • Step 201 The forwarding device obtains a trapping target set.
  • the trap target set includes at least one trap target, and the at least one trap target includes an unused IP address or an unopened port number on the used IP address.
  • at least one trap target can be all unused IP addresses, all unopened port numbers on the used IP addresses, or part of the unused IP addresses and the rest are used.
  • the IP address involved in the trapping target is an IP address within at least one subnet to which the forwarding device is connected.
  • the unused IP address is relative to the used IP address, and the unused IP address refers to an IP address that is not configured to any host in the internal network.
  • the used IP address refers to the IP address that has been allocated to a host.
  • the port number involved in the trapping target refers to the logical port number on the computer device. An unopened port number means that the host does not use the port number to provide services to other hosts on the network.
  • the trapping target set is represented by a trapping target table.
  • the trapping target table includes at least one entry, and each entry in the at least one entry is used to indicate a trapping target, and each entry includes an IP address or a combination of an IP address and a port number.
  • Table 1 is an example of the trapping target table, and the trapping target table shown in Table 1 contains two entries.
  • the trapping target indicated by entry 1 is the unopened port 80 on the IP address 1.1.1.103, and the trapping target indicated by entry 2 is the unused IP address 1.1.1.105.
  • the forwarding device receives an unused IP address input by a network administrator through an input interface, and the input interface of the forwarding device is connected to an input device using a keyboard as an example.
  • the Dynamic Host Configuration Protocol (DHCP) server assigns IP addresses to the hosts in the network, and the forwarding device obtains unused IP addresses from the DHCP server.
  • DHCP Dynamic Host Configuration Protocol
  • embodiments of the present application also provide embodiments in which multiple forwarding devices obtain trapping target sets through active learning, which will be described in detail in the following embodiments with reference to the accompanying drawings.
  • Step 202 The forwarding device receives the first IP packet, and the first IP packet comes from the first host.
  • the forwarding device is the forwarding device 110 in FIG. 1 as an example for illustration.
  • the first host is the host 101 in FIG. 1.
  • the source IP address of the first message is the IP address 1.1.1.101 of the host 101.
  • Step 203 The forwarding device determines whether the destination party to which the first IP packet requests access belongs to a trap target set.
  • the destination party requesting access is indicated by the destination IP address or the combination of the destination IP address and the destination port number.
  • the forwarding device performs IP header analysis on the first IP packet, so as to obtain the destination IP address of the first IP packet or a combination of the destination IP address and the destination port number of the first IP packet.
  • the forwarding device compares the obtained destination IP address of the first IP packet, or the combination of the destination IP address and destination port number of the first IP packet with the entries in the trapping target table shown in Table 1, respectively, if it is compared with If one of the entries has the same content, it is determined that the destination party to which the first IP packet requests access belongs to the trapping target set, and step 204 is executed. If the content is not the same as any of the entries, it is determined that the destination of the first IP packet requesting access is not a trapping target, and the routing table is searched according to the destination IP address of the first packet, or the ARP table and the routing table are found Corresponding interface number, use the corresponding interface to send the first message.
  • the process of forwarding packets according to the routing table is an existing switch function, and will not be detailed here.
  • Step 204 The forwarding device sends the first IP packet to the honeypot management server.
  • the forwarding device sends the first IP packet to the honeypot management server through the tunnel between the forwarding device and the honeypot management server.
  • sending the first IP packet through the tunnel refers to encapsulating the first IP packet based on the parameters of the pre-established tunnel and the tunnel protocol type. That is, the forwarding device uses the first IP message as the payload part of the tunnel message, adds a tunnel protocol header to the first IP message, thereby generating the first tunnel message, and sends the first tunnel message to the honeypot management server.
  • the forwarding device and the honeypot management server establish a tunnel between them based on multiple different protocols, and the tunnel between the forwarding device and the honeypot management server includes, but is not limited to, a UDP tunnel, a VXLAN tunnel, and a GRE tunnel.
  • Step 205 The forwarding device receives the second IP packet returned by the honeypot management server.
  • the forwarding device receives a second IP packet through the above-mentioned tunnel, where the second IP packet is a response packet of the first IP packet returned by the honeypot management server.
  • receiving the second IP packet through the tunnel refers to decapsulating the second tunnel packet returned by the honeypot server based on the parameters of the tunnel and the tunnel protocol type, and obtaining the second IP included in the payload part of the second tunnel packet Message.
  • Step 206 The forwarding device sends the second IP packet to the first host.
  • the host 101 is used as a springboard to detect or attack other hosts in the internal network. For example, use host 101 to scan other hosts in the internal network, try to obtain information of another host, and then try to log in to another host, so as to obtain sensitive information stored on another host or use vulnerabilities on another host to reach other hosts. The purpose of the attack.
  • the host 101 sends an IP message (denoted as message 1) to another IP address 1.1.1.103 in the same subnet.
  • the source IP address of message 1 is the IP address 1.1.1.101 of the host 101, the port number is 1000, the destination IP address is 1.1.1.103, and the destination port number is 80.
  • the forwarding device 110 After receiving the message 1, the forwarding device 110 looks up the trapping target table shown in Table 1 according to the destination IP address and the destination port number of the message 1, and determines that the combination of the destination IP address and the destination port number of the message 1 is the same as the content of the table item 1. Therefore, the destination of the message 1 requesting access is a trap target.
  • the forwarding device 110 encapsulates the message 1 through the tunnel between the honeypot management server 120 and adds a tunnel protocol header to generate a tunnel message (denoted as message 1X), and the message 1 is carried in the payload part of the message 1X .
  • the source IP address in the message 1X tunneling protocol header is the IP address 2.2.2.1 of the switch 110
  • the source port number is the port number 1234 on the switch 110
  • the destination IP address in the message 1X tunneling protocol header is the honeypot management
  • the IP address of the server 120 is 2.2.2.2
  • the destination port number is the port number 1234 of the honeypot management server 120.
  • the honeypot management server 120 stores a predetermined algorithm.
  • the function of the predetermined algorithm is to allocate a honeypot host to process the message1.
  • the predetermined algorithm is to allocate the packet with the access port number 80 to the honeypot host 1 for processing according to the preset correspondence between the port number and the honeypot host identifier.
  • the honeypot management server 120 After receiving the message 1X, the honeypot management server 120 decapsulates the message 1X, and obtains the message 1 in the payload part of the message 1X.
  • the honeypot management server 120 maps to the honeypot host 1 according to the destination port number 80 of the message 1 according to a predetermined algorithm.
  • the honeypot management server 120 replaces the destination IP address of message 1 with the IP address of the honeypot host 1 being 172.1.1.1, and generates a replaced message, which is recorded as message 1'.
  • the honeypot management server 120 records the correspondence between the destination IP address 1.1.1.101 before the replacement and the destination IP address 172.1.1.1 after the replacement, and the destination port number remains unchanged.
  • the honeypot management server 120 sends message 1'to the honeypot host 1.
  • the honeypot management server 120 receives the response message message 2 returned by the honeypot host 1 for message 1'.
  • the source address of message 2 is that the IP address of honeypot host 1 is 172.1.1.1, and the source port number is 80.
  • the honeypot management server 120 replaces the source IP address of message 2 from 172.1.1.1 to 1.1.1.103 according to the previously recorded correspondence, thereby generating a replaced message, denoted as message 2'.
  • the honeypot management server 120 encapsulates the message 2'through the tunnel with the forwarding device 110, adds a tunnel protocol header, and generates a tunnel message (denoted as message 2X).
  • the message 2' is carried in the message 2X Load part.
  • the destination IP address in the message 2X tunneling protocol header is the IP address 2.2.2.1 of the forwarding device 110, the destination port number is the port number 1234 on the forwarding device 110, and the source IP address in the message 2X tunneling protocol header is honey
  • the IP address of the pot management server 120 is 2.2.2.2, and the source port number is the port number 1234 of the honeypot management server 120.
  • the forwarding device 110 After receiving the message 2X, the forwarding device 110 decapsulates the message 2X to obtain the message 2'in the payload part of the message 2X.
  • the switch sends a message 2'to the host 101 according to the destination IP address 1.1.1.101 of the message 2'. In this way, from the perspective of the host 101, a host with an IP address of 1.1.1.103 and a port 80 opened can be virtualized to communicate with the honeypot host 1.
  • the forwarding device in the internal network taking the switch as an example, is based on the actual network environment, and uses unused addresses or ports in the subnet connected to the forwarding device to simulate a large number of honeypots.
  • the forwarding device is used as a trapping solution.
  • a host potentially controlled by hackers or malware
  • the forwarding device creates a set of trapping targets. Thereafter, the forwarding device sends the message requesting access to the trapping target to the honeypot management server, and sends the corresponding return message from the honeypot server to the initiator of the above request.
  • the decoy system deceives the initiator into thinking that there is a target party requesting access in the network, and can subsequently communicate with the target party requesting access, so that the decoy system can obtain hackers or malware behaviors during the communication process.
  • it is for researchers to analyze or crack, on the other hand, delay the invasion of other hosts on the internal network, so as to realize the process of capturing network threats.
  • the threat trapping solution provided by the embodiment of the present application is mainly implemented by the forwarding device, and there is no need to set up an agent in the host of the internal network, thus reducing the deployment and maintenance cost of the trapping system.
  • the threat trapping solution provided by the application embodiment uses idle address resources in the actual network to implement a honeypot, so as to avoid affecting normal services in the internal network.
  • the embodiments of the present application mainly introduce three ways for forwarding devices to create trapping target sets according to actual network environments.
  • the first method is that the forwarding device acquires the trapping target and adds the trapping target to the trapping target set in the process of processing the ARP request initiated by the communication requester.
  • the second method is that the forwarding device obtains the trapping target and adds the trapping target to the trapping target set during the execution of the IP packet forwarding process.
  • the third method is that the forwarding device obtains the trapping target and adds the trapping target to the trapping target set during the process of processing the first predetermined type of message of the communication requester in the stage of establishing the IP session.
  • the first predetermined type of message includes an RST message or an ICMP unreachable message.
  • the forwarding device may delete the trapping target in the trapping target set when processing the second predetermined type of message, so as to achieve the purpose of updating the trapping target set.
  • the second predetermined type of message is SYN-
  • the forwarding device when it creates a trapping target set, it can choose to use a method of creating a trap target set to create a trap target set, or it can selectively use a combination of multiple methods of creating a trap target set to create a trap.
  • the target set also chooses whether to use it in combination with the above method of updating the trapping target set to create the trapping target set.
  • the network administrator can configure the specific scheme used when creating the trap target set according to actual network requirements and multi-factor considerations.
  • FIG. 3A is a flowchart of a method for creating a trapping target set provided by an embodiment of the present application.
  • Figure 3A mainly describes the first method of creating a trapping target set based on the actual network environment, that is, the forwarding device acquires the trapping target and adds the trapping target to the trapping target set during the process of processing the ARP request initiated by the communication requester.
  • Step 300 The forwarding device receives an ARP message.
  • ARP is a protocol that resolves IP addresses into MAC addresses (or physical addresses).
  • MAC addresses or physical addresses.
  • ARP is used to implement the mapping from IP address to MAC address.
  • the length of the ARP message is 42 bytes.
  • the first 14 bytes are the Layer 2 (Ethernet) message header, which carries the active MAC address, destination MA address, and frame type.
  • the operation type (op) field in the last 28 bytes is used to identify whether an ARP message is an ARP request message or an ARP response message. Specifically, the content of the op field 1 is an ARP request, 2 is an ARP response, 3 is a RARP request, and 4 is a RARP response.
  • the function of the ARP request message and the ARP response message is to learn the ARP table entries corresponding to the communication peer. If two hosts (host A and host B) are in the same subnet, the process of sending information from host A to host B includes the following steps. Host A searches the ARP table on Host A according to the IP address of Host B to determine whether the ARP table on Host A contains the ARP entry corresponding to Host B. The ARP entry corresponding to Host B includes the IP address and host of Host B. B's MAC address. If the corresponding ARP entry of the host B is found, the MAC address of the host B is obtained from the found entry.
  • the MAC address of host B is used as the destination MAC address, encapsulate the IP packet into an Ethernet frame and send it to host B. If the corresponding ARP table entry of host B cannot be found, an ARP request message is sent in broadcast mode.
  • the source IP address and source MAC address in the ARP request message are the IP address of host A and the MAC address of host A, respectively.
  • the destination IP address and destination MAC address are the IP address of host B and the MAC address of full F (FFFF.FFFF.FF.FFFF). All hosts in the subnet will receive ARP request packets.
  • Host B compares its own IP address with the destination IP address in the ARP request message.
  • the ARP response message contains the MAC address of host B, and the ARP response message is sent to host A in unicast mode.
  • host A and host B are in different subnets, the message needs to be sent through the gateway.
  • Host A sends the message to the gateway first, and then sends the message to host B through the gateway. If the ARP entry of host B does not exist in the ARP table saved by the gateway, it will broadcast an ARP request message whose destination IP address is the IP address of host B, and obtain the MAC address of host B from the corresponding ARP response message.
  • gratuitous ARP packets refer to packets whose source IP address and destination IP address are the same.
  • the gratuitous ARP message has two main purposes: one is that the device sending the gratuitous ARP message advertises its ARP information to other peripheral devices, so that other devices can learn the ARP table entries that contain the IP address and MAC address of the device , So that you don’t need to re-request ARP when sending information later; the second is to detect IP address conflicts. If the device sending the gratuitous ARP message receives a response message for the gratuitous ARP message, it means that the IP address of this device is used by other devices. took up. A host can send gratuitous ARP packets when the MAC address changes or the IP address changes.
  • Step 301 The forwarding device determines whether the type of the ARP message is an ARP request message, an ARP response message, or a gratuitous ARP message. If it is an ARP request message, step 302 is executed. If it is an ARP response message or a gratuitous ARP message, step 306 is executed.
  • the forwarding device can identify whether the ARP message is an ARP request message or an ARP response message according to the op field of the ARP message. By comparing whether the source IP address and destination IP address of the ARP message are the same, it can be determined whether the ARP message is a gratuitous ARP message. If the source IP address and destination IP address of the ARP packet are the same, it is confirmed that it is a gratuitous ARP packet.
  • Step 302 The forwarding device determines the online status of the destination IP address of the ARP message according to the IP address status table.
  • the IP address status table is used to indicate the online status of multiple IP addresses within at least one subnet to which the forwarding device is connected, and the online status is online or offline.
  • the IP address status table may save only the IP addresses whose online status is offline, or simultaneously save the IP addresses whose online status is online and the IP addresses whose online status is offline. If the IP address status table can only store IP addresses whose online status is offline, the IP address status table can only store IP addresses, and the default IP address status included in the IP status table is offline. If the IP address status table saves both the IP addresses whose online status is online and the IP addresses whose online status is offline, the IP address and the online status corresponding to each IP address need to be saved in the IP address status table.
  • the first IP address and the second IP address are respectively two IP addresses among multiple IP addresses in the subnet to which the forwarding device is connected.
  • the IP address status table is obtained through the following steps: the forwarding device sends an ARP request message for each of the multiple IP addresses in the subnet range to which the forwarding device is connected; if the forwarding device does not receive the first IP address Address, add the first IP address to the IP address status table, where the first IP address is an IP address among the multiple IP addresses; and add the first IP address Is set to offline.
  • the forwarding device receives an ARP response message for the second IP address, it will The IP address is added to the IP address status table, the second IP address is an IP address among the multiple IP addresses; and the status of the second IP address is set to online.
  • the host may be unable to respond to ARP request packets in a timely manner due to a temporary failure.
  • forwarding can send an ARP request message to one IP address multiple times, and when a predetermined condition (such as a predetermined When the corresponding ARP response message is not received, the requested IP address is added to the capture target set.
  • a predetermined condition such as a predetermined When the corresponding ARP response message is not received, the requested IP address is added to the capture target set.
  • the IP address status table is obtained through steps 3021 to 3025.
  • the forwarding device is connected to at least one subnet, and each subnet contains multiple IP addresses.
  • the forwarding device performs step 3021 to step 3025 for an IP address in the range of these subnets to obtain the online status of this IP address.
  • the forwarding device performs a similar process for multiple IP addresses in the subnet range, thereby obtaining an IP address status table indicating the online status of the multiple IP addresses.
  • the embodiment of the present application obtains a state corresponding to an IP address (that is, the selected IP address) as an example for description.
  • the forwarding device constructs an IP address space table corresponding to the subnet according to the subnet type, and the IP address space table includes each IP address in the subnet. Similar steps are performed for each IP address in the IP address space table to obtain online status.
  • the forwarding device can periodically (for example, 0:00-1:00 every day) read each IP address sequentially from the IP address space table, and perform broadcast ARP request messages for each IP address read. The online status is determined based on the ARP response message, and each IP address can also be read in other ways, as long as it is guaranteed to perform steps 3021 to 3025 for each IP address to obtain the corresponding online status.
  • the forwarding device selects an IP address from at least one IP address in the range of at least one connected subnet, and performs the following processing on the selected IP address until the following operations are performed on the at least one IP address.
  • Step 3021 The forwarding device sends an ARP request message when the predetermined detection period arrives, and the destination IP address of the ARP request message is the selected IP address.
  • the forwarding device uses a timer to broadcast the ARP request message according to a predetermined period.
  • the detection period can be set to 1 second or 0.1 second, etc. Obviously, the detection period should not be set too long, it should be much shorter than the detection period of 1 hour as an example.
  • Step 3022 The forwarding device records whether a response message for the ARP request message is received before the end of the current period.
  • the forwarding device records whether the corresponding ARP response message is received for each cycle. Assume that in a cycle, if the forwarding device receives a response message for the ARP request message before the end of this cycle, step 3023 is executed, and if it does not receive a response message for the ARP request message before the end of this cycle In response to the packet, go to step 3024.
  • Step 3023 The forwarding device sets the status of the selected IP address as online in the IP status table. Return to step 3021.
  • Step 3024 The forwarding device determines whether the number of consecutive cycles (for example, 10 cycles) in which the response message for the ARP request message is not received exceeds a predetermined number according to whether the ARP response message is received in each recorded cycle. value. If the number of consecutive cycles in which the response message for the ARP request message is not received does not exceed the predetermined value, step 3023 is executed to temporarily set the status of the selected IP address to online. The number of consecutive cycles of the response message of the ARP request message has exceeded the predetermined value, and step 3025 is executed.
  • the number of consecutive cycles for example, 10 cycles
  • Step 3025 The forwarding device sets the status of the selected IP address as offline in the IP status table, and returns to step 3021.
  • the forwarding device determines that the online status of the destination IP address of the ARP message is online, it will forward the ARP message according to the existing ARP message forwarding process. If it is determined that the online status of the destination IP address of the ARP packet is offline, step 303 is executed.
  • step 303 if the online status of the destination IP address of the ARP message received in step 300 is offline, the forwarding device adds the destination IP address of the ARP request message as an unused IP address to the trap target set.
  • the forwarding device creates an entry.
  • the created entry includes the destination IP address of the ARP request message.
  • the forwarding device further adds the created entry to the trapping target table.
  • the forwarding device uses an ARP request message containing the destination IP address as an unused IP address and finds a detection attempt by a host in the internal network.
  • the host may be controlled by hackers or malware. Therefore, at this time, determine the target that the subsequent honeypot system needs to simulate, that is, the trap target.
  • the forwarding device In order to allow the potentially controlled host to communicate with the trapping target, after determining that the online status of the destination IP address of the ARP message is offline in step 302, before adding the destination IP address of the ARP message to the trapping target set in step 303, It also includes step 305, the forwarding device returns an ARP response, the ARP response carries a forged MAC address, and the forged MAC address is used as the MAC address of the host with the destination IP address of the ARP request message. In the case of using the trapping target table shown in Table 1 to store the trapping target set, the forwarding device may also store the forged MAC address in the entry created in step 303.
  • a whitelist is set up on the forwarding device, and the whitelist includes the IP address or MAC address of the host known to be used by legitimate users.
  • the forwarding device first queries the white list after receiving an ARP packet. If the source IP address, source MAC address, destination IP address, or destination MAC address of the ARP message belongs to the white list, the ARP message can be forwarded directly according to the existing ARP message forwarding process. The forwarding device omits performing steps 301 to 303 in FIG. 3A.
  • the forwarding device receives the ARP message in step 300, the IP address used by the host sending the ARP message can be considered to be online, and the forwarding device updates the IP status table according to the source IP address of the ARP message.
  • the online status corresponding to the source IP address of the ARP packet in the IP status table is updated to online.
  • step 301 if the forwarding device determines that the type of the ARP message is an ARP response message or a gratuitous ARP message, it means that the host sending the ARP response message or gratuitous ARP message is normally online Host instead of the host virtualized by the honeypot system.
  • the destination of the request for access is an unused IP address (an offline IP address)
  • the ARP response packet is actively forged by the forwarding device, and will not be received by the forwarding device.
  • the IP address used by the sender of the gratuitous ARP message can be considered an online IP address. Therefore, if the forwarding device determines that the type of the ARP packet is an ARP response packet or a gratuitous ARP packet, step 306 is executed. This is equivalent to increasing the opportunity to update the IP address status table.
  • Step 306 The forwarding device judges whether there is a source IP address containing the ARP packet in the trapping target set. If there is an entry containing the source IP address of the ARP packet in the trap target set, step 307 is executed.
  • Step 307 Delete the source IP address of the ARP packet that is the unused IP address from the trapping target set.
  • the forwarding device deletes the entry containing the source IP address of the ARP packet.
  • step 306 If it is determined in step 306 that the source IP address of the ARP message does not exist in the trap target set, or the source IP address of the ARP message is deleted from the trap target set in step 307, the ARP message is forwarded.
  • the trapping target set can be updated to avoid using the IP address used by the host performing normal services in the internal network as the trapping target, and avoid affecting normal services in the internal network.
  • the source address of the IP packet is the IP address used by the host that sent the IP packet.
  • the source address of the IP message is the used IP address, not the unused IP address. Therefore, if the source address of the IP packet is contained in the trap target set, the source address of the IP packet should be deleted from the trap target set to prevent the host sending the IP packet from being unable to communicate with other hosts.
  • This embodiment describes in detail the process in which the forwarding device determines the unused IP address in the connected subnet as the trap target. After the forwarding device uses this method to construct the trapping target set, the subsequent forwarding device realizes diversion according to the trapping target set.
  • Fig. 4 is a flowchart of another method for creating a trapping target set provided by an embodiment of the present application.
  • Fig. 4 mainly describes the above-mentioned second method of creating a trapping target set based on the actual network environment, that is, the forwarding device obtains the trapping target and adds the trapping target to the trapping target set during the IP packet forwarding process.
  • Step 400 The forwarding device receives an IP packet.
  • the process shown in FIG. 4 can be implemented separately or combined with the process shown in FIG. 2 or FIG. 3A.
  • the step 400 in FIG. 4 is received
  • the message is called the third IP message.
  • the third IP packet is not the second IP packet in FIG. 2.
  • the third IP packet may be the first IP packet in FIG. 2, or it may be another IP packet different from the first IP packet and the second IP packet.
  • Step 401 The forwarding device queries the routing table of the forwarding device for the next hop IP address corresponding to the third IP packet according to the destination IP address of the third IP packet. If the next hop IP address corresponding to the third IP packet exists in the routing table, step 420 is executed; if the next hop IP address corresponding to the third IP packet does not exist in the routing table, step 430 is executed.
  • Step 420 The forwarding device queries the MAC address corresponding to the next hop IP address in the ARP table. If the MAC address corresponding to the next hop IP address does not exist in the ARP table, step 421 is executed. If the MAC address corresponding to the next hop IP address exists in the ARP table, step 423 is executed.
  • Step 421 The forwarding device determines the online status of the destination IP of the third IP packet according to the IP address status table. Please refer to the description in the previous embodiment for the method of obtaining the IP address status table, which is not repeated here.
  • step 422 is executed. If the online status of the destination IP of the third IP packet is offline, step 430 is executed.
  • Step 422 The forwarding device initiates an ARP learning process, and forwards the third IP packet according to the destination MAC address learned subsequently. Step 423 is executed.
  • Step 423 The forwarding device forwards the third IP packet according to the existing IP packet forwarding process.
  • Step 430 The forwarding device adds the destination IP address of the third IP packet as an unused IP address to the trapping target set.
  • the forwarding device creates an entry.
  • the created table entry contains the destination IP address of the third IP packet.
  • the forwarding device further adds the created entry to the trapping target table.
  • the forwarding device can also trap the third IP packet, that is, perform steps 440-442.
  • Step 440 The forwarding device sends the third IP packet to the honeypot management server.
  • Step 441 The forwarding device receives a response message for the third IP message from the honeypot management server.
  • Step 442 The forwarding device forwards the response message.
  • Fig. 5 is a flowchart of another specific method for creating a trapping target set provided by an embodiment of the present application.
  • Figure 5 mainly describes the above-mentioned third method of creating a trapping target set based on the actual network environment, that is, the forwarding device is processing the first predetermined type of packet (that is, the RST packet or ICMP unavailability of the communication requester during the establishment of the IP session.
  • the trapping target is obtained and the trapping target is added to the trapping target set.
  • the process shown in Fig. 5 can be implemented alone or combined with the process shown in Figs. 2, 3A or 4 for application.
  • the second IP packet in the process shown in FIG. 2 when the process shown in FIG.
  • the message is called the fourth IP message. It should be pointed out that the fourth IP packet is not the second IP packet in FIG. 2.
  • the fourth IP packet can be the first IP packet in Figure 2 or the third IP packet in Figure 4, or it can be different from the first IP packet, the second IP packet, and the first IP packet. Another IP packet of three IP packets.
  • the method shown in FIG. 5 mainly describes the process of determining the unopened port on the IP address used in the subnet access as the trap target.
  • the process shown in FIG. 5 describes the process of how to add unopened ports on the used IP addresses to the trapping target set based on a known trapping target set containing unused IP addresses in the subnet.
  • the process of individually determining the trapping target set containing the unopened ports on the used IP address includes a sub-process composed of steps 503 to 513 in FIG. 4.
  • the method shown in Figure 5 creates a trapping target set during the TCP session establishment phase.
  • Step 501 The forwarding device receives the fourth IP packet.
  • the forwarding device is connected to several hosts in the subnet and to the honeypot management server 120 via multiple interfaces.
  • the forwarding device may also be connected to other forwarding devices, such as gateways or other switches, through some of the interfaces.
  • a forwarding table is stored in the forwarding device, and multiple forwarding table entries are stored in the forwarding table.
  • Each forwarding table entry contains the interface identification of an interface on a switch and the information of other devices connected to the interface. The correspondence between MAC addresses.
  • Step 502 The forwarding device determines whether the received fourth IP packet comes from the honeypot management server.
  • the forwarding device knows the IP address and MAC address of the honeypot management server, if the MAC address corresponding to the interface on which the fourth IP message is received is the same as the MAC address of the honeypot management server, the forwarding device can determine The fourth IP message comes from the honeypot management server. Conversely, if the MAC address corresponding to the interface receiving the fourth IP packet is different from the MAC address of the honeypot management server, the forwarding device can determine that the fourth IP packet does not come from the honeypot management server.
  • the fourth IP packet is sent through the tunnel between the forwarding device and the honeypot management server, and the forwarding device decapsulates the fourth IP packet , Obtain the message carried in the payload of the fourth IP message, and forward the obtained message, that is, step 520 is performed.
  • step 503 is executed.
  • Step 503 The forwarding device judges whether the fourth IP packet is a SYN packet, a SYN_ACK packet, or an RST packet.
  • the TCP message header includes 6 flags (flags) each of 1 bit, which are URG, ACK, PSH, RST, SYN, and FIN.
  • flags flags
  • URG indicates that the Urgent pointer field in the TCP message header is meaningful.
  • the ACK indicates that the Acknowledgment (Acknowledgment) field is meaningful, which means that the TCP packet is a response packet.
  • PSH stands for push function, requesting to push cached data into the receiving application, which means that there is data transmission.
  • RST means to reset the connection.
  • SYN represents the synchronization sequence number, that is, the connection is established.
  • FIN indicates that the TCP message is the last message from the sender, which means that the connection is closed.
  • a message with only the flag bit SYN set to 1 is called a SYN message
  • a message with the flag bit SYN and ACK set to 1 at the same time is called a SYN_ACK message
  • a message with the flag bit RST set to 1 is called a SYN message. It is called RST packet.
  • the messages in the TCP protocol connection establishment process include SYN, SYN_ACK, and RST messages.
  • SYN and SYN_ACK belong to the message in the three-way handshake process, and the three-way handshake is used to establish a TCP connection between the two communicating parties.
  • the RST (reset) message is used to abnormally close the connection.
  • the TCP protocol stack handler on the host will send the RST packet at the abnormal moment it thinks. For example, host A initiates a connection to host B, but host B does not open the port for monitoring host A's request to establish a connection. At this time, the TCP protocol stack handler on host B sends an RST message.
  • the forwarding device executes step 504. If the fourth IP packet is a SYN packet, the forwarding device executes step 507. If the fourth IP packet is a SYN_ACK packet, the forwarding device executes step 508. If the fourth IP packet is an RST packet, the forwarding device executes step 512.
  • the IP protocol also includes the UDP protocol.
  • UDP protocol processing process if a host receives a UDP datagram and the destination port number of the UDP datagram does not match the port number corresponding to the process being used on the host, then the host returns an ICMP unreachable report Text. Therefore, the ICMP unreachable message has a similar function to the RST message, that is, it indicates that the port number requested to access is not open. Therefore, the subsequent embodiments describe the ICMP unreachable message and the RST message together.
  • a whitelist is set up on the forwarding device, and the whitelist includes the IP address or MAC address of the host known to be used by legitimate users.
  • the forwarding device After the above step 501 and before step 503, after the forwarding device receives an IP packet, it first queries the white list, if the source IP address, source MAC address, destination IP address or destination MAC address of the IP packet belong to the white list , Then directly forward the IP message according to the existing IP message forwarding process.
  • the forwarding device does not need to recognize that the IP packet is a SYN, SYN_ACK, or RST packet and subsequent procedures, that is, step 503 and other subsequent steps are omitted.
  • Step 504 The forwarding device determines whether the destination of the fourth IP packet requesting access belongs to an existing trapping target, that is, whether the fourth IP packet should be trapped. For the specific implementation details of this step, please refer to the description of step 203 in FIG. 2, which will not be repeated here. If the destination of the fourth IP packet requesting access belongs to an existing trapping target, step 505 is executed. If the destination of the fourth IP packet requesting access does not belong to the existing trapping target, step 506 is executed.
  • Step 505 The forwarding device sends the fourth IP packet to the honeypot management server through the tunnel between the forwarding device and the honeypot management server.
  • the honeypot management server For the specific implementation details of this step, please refer to the description of step 204 in FIG. 2, which will not be repeated here.
  • Step 506 The forwarding device forwards the fourth IP packet according to the MAC table, or forwards the fourth IP packet according to the routing table combined with the ARP table. Specifically, if the MAC table of the forwarding device saves the interface number corresponding to the destination MAC address of the IP packet, the forwarding device finds the interface corresponding to the destination MAC address of the IP packet according to the MAC table, and transfers all data through the corresponding interface. The IP message is sent out. If the MAC table of the forwarding device does not store the interface number corresponding to the destination MAC address of the IP message, the forwarding device forwards the IP message according to the routing table and the ARP table.
  • the forwarding device performs the processing flow described in FIG. 4 on the fourth IP packet that enters step 506.
  • the packet received in step 400 in FIG. 4 is the IP packet received by the forwarding device 110 from any interface in FIG. 1, or it can be the fourth IP packet input in step 506 in FIG. Text.
  • the trapping target also includes an unopened port on the used IP address. If the fourth IP packet meets the following trapping conditions, it means that the destination of the fourth IP packet is an unopened port on the used IP address.
  • the trapping condition is: before receiving the fourth IP message, at least one SYN message corresponding to the fourth IP message is received, and the destination IP address of the SYN message corresponding to the fourth IP message is The source IP address of the fourth IP packet is the same, and the destination port number is the same as the source port number of the fourth IP packet.
  • the forwarding device uses the source IP address of the fourth IP packet as the used IP address and the source port number of the fourth IP packet as the all The unopened port number on the IP address indicated by the source IP address of the fourth IP packet is added to the trap target set.
  • the forwarding device can adopt more stringent trapping conditions to improve the accuracy of determining trapping targets.
  • the trapping condition is: at least one SYN packet corresponding to the fourth IP packet is received before the predetermined period of time before the fourth IP packet is received, and the data received within the predetermined period of time corresponds to all
  • the other packets with the same source IP address and source port number of the fourth IP packet are all RST packets, and the destination IP address of the SYN packet corresponding to the fourth IP packet is the same as that of the fourth IP packet.
  • the source IP address is the same and the destination port number is the same as the source port number of the fourth IP packet.
  • the ICMP unreachable message has a similar function to the aforementioned RST message. If the fourth IP packet is an ICMP unreachable packet. Then the corresponding trapping conditions include: before receiving the fourth IP packet, at least one UDP packet corresponding to the fourth IP packet is received, and the destination IP of the UDP packet corresponding to the fourth IP packet The address is the same as the source IP address of the fourth IP packet, and the destination port number is the same as the source port number of the fourth IP packet.
  • the forwarding device uses the source IP address of the fourth IP packet as the used IP address and the source port number of the fourth IP packet as the all The unopened port number on the IP address indicated by the source IP address of the fourth IP packet is added to the trap target set.
  • the more stringent trapping conditions include: receiving at least one and the fourth IP packet before a predetermined period of time before receiving the fourth IP packet.
  • the UDP packets corresponding to the IP packets and other packets that have the same source IP address and source port number as the fourth IP packet received within the predetermined time period are all ICMP unreachable packets, so The destination IP address of the UDP packet corresponding to the fourth IP packet is the same as the source IP address of the fourth IP packet, and the destination port number is the same as the source port number of the fourth IP packet.
  • the forwarding device uses the source IP address of the fourth IP packet as the used IP address and the source port number of the fourth IP packet as the all The unopened port number on the IP address indicated by the source IP address of the fourth IP packet is added to the trap target set.
  • the forwarding device receives a RST packet with a source IP address of 1.1.1.103 and a source port number of 80 at time A.
  • the forwarding device received a SYN message with a destination address of 1.1.1.103 and a destination port number of 80, and within 1 minute before time A, the source IP address was 1.1.1.103.
  • the packets whose source port number is 80 are all RST packets, and port 80 on the IP address 1.1.1.103 is determined as the trap target.
  • the forwarding device determines that port 80 on the IP address 1.1.1.103 is the trap target.
  • the forwarding device can use multiple methods to identify the unopened port on an used IP address.
  • the forwarding device establishes a SYN request table to identify potential trapping targets.
  • the SYN request table is used to record request destinations that have received SYN messages but have not successfully established a connection.
  • the SYN request table includes one or more SYN entries.
  • the forwarding device receives a SYN message, it queries whether there is a SYN entry in the SYN request table that contains the combination of the destination IP address and the destination port number of the SYN message. If there is already a SYN entry containing the combination of the destination IP address and the destination port number of the SYN message, the SYN request table is not updated. If there is no SYN entry containing the combination of the destination IP address and the destination port number of the SYN packet, a SYN entry is created, and the SYN entry includes the combination of the destination IP address and the destination port number of the SYN packet . The SYN entry also includes the time when the SYN message was received.
  • each SYN entry in the SYN request table also includes a count value for recording the number of received RST packets.
  • the forwarding device queries the SYN request table to see if there is a SYN entry that contains the combination of the source IP address and the source port number of the RST message. If there is already a SYN entry containing the combination of the source IP address and the source port number of the RST packet, the count value in the SYN entry is accumulated by one.
  • steps 507 to 512 take the SYN record table as an example to introduce how to identify the unopened ports on the used IP address. Obviously, the method of determining whether a port number meets the above trapping conditions is not limited to the methods shown in steps 507-512.
  • Step 507 The forwarding device queries the SYN request table according to the destination IP address and destination port number of the fourth IP packet. If there is no corresponding SYN entry, it creates a SYN entry and adds the SYN entry to the SYN table .
  • the SYN entry includes the combination of the destination IP address and the destination port number of the SYN message.
  • the established SYN request table is shown in Table 3.
  • step 507 the forwarding device executes step 506 to forward the fourth IP packet of the SYN type.
  • the fourth IP packet is a SYN_ACK packet, it indicates that the fourth IP packet originated from an online IP address and from an open port on an online IP address, so the fourth IP packet
  • the source address of and the combination of source address and source IP address are not trapped targets.
  • the trapping target table and the SYN request table can be updated.
  • Step 508 In the case that the fourth IP packet is a SYN_ACK packet, the forwarding device determines whether there is a trapping target table that contains the source IP address, or source IP address and source port number of the fourth IP packet. The combined table entry. If there is an entry that contains the source IP address or the combination of the source IP address and the source port number of the fourth IP packet in the trap target table, step 509 is executed. If there is no entry in the trapping target table that contains the source IP address of the IP packet or the combination of the source IP address and the source port number, step 510 is executed.
  • Step 509 The forwarding device deletes an entry containing the source IP address or a combination of the source IP address and the source port number of the fourth IP packet from the trapping target table.
  • Step 510 The forwarding device judges whether there is an entry in the SYN request table that contains the combination of the source IP address and the source port number of the fourth IP packet. If there is an entry in the SYN request table that contains the combination of the source IP address and the source port number of the fourth IP packet, step 511 is executed. If there is no entry in the trapping target table that includes the source IP address or the combination of the source IP address and the source port number of the fourth IP packet, step 506 is executed.
  • Step 511 The forwarding device deletes an entry containing the combination of the source IP address and the source port number of the fourth IP packet from the SYN table.
  • Step 506 is executed after the entry of the combination of numbers.
  • the fourth IP message is a RST message
  • the SYN request table should be combined to confirm the source of the RST message Whether the port number meets the trapping conditions.
  • the trapping condition is met, the source port of the RST packet is added to the trapping target. If the trapping condition is not met, the record in the SYN request table is updated.
  • Step 512 The forwarding device queries the SYN request table according to the source IP address and source port number of the fourth IP packet. If the SYN request table contains an entry whose content is the same as the source IP address and source port number of the IP packet, and the time in the entry exceeds the set threshold for receiving the IP packet, execute Step 513. If there is no entry in the SYN request table that has the same content as the source IP address and source port number of the IP packet, or the time in the entry does not exceed the set threshold when the IP packet is received, Step 506 is executed.
  • Step 513 The forwarding device uses the source IP address of the fourth IP packet as the used IP address, and uses the source port number of the fourth IP packet as the source IP address of the fourth IP packet. Port numbers that are not open on the IP address are added to the trap target set.
  • the forwarding device creates an entry, and the newly created entry contains the source IP address of the fourth IP packet and the fourth IP The combination of the source port number of the message adds the newly created entry to the trap target table.
  • Step 514 The forwarding device sends a SYN packet corresponding to the fourth IP packet of type RST to the honeypot management server through the tunnel between the honeypot management server.
  • the corresponding SYN packet is a SYN packet whose destination IP address is the same as the source IP address of the fourth IP packet and the destination port number is the same as the source port number of the fourth IP packet.
  • the SYN packet sent by the forwarding device to the honeypot management server is that the forwarding device can temporarily store the previously received SYN packet corresponding to the fourth IP packet of type RST.
  • the SYN message sent by the forwarding device to the honeypot management server may also be that the forwarding device regenerates a fourth IP packet corresponding to the RST type when it determines that the fourth IP packet meets the above trapping conditions. SYN message.
  • the above processing procedure performed on the RST message is also applicable to the ICMP unreachable message.
  • Fig. 6 is a flowchart of a method for actively implementing trapping using IP addresses in a trap target set provided by an embodiment of the present application.
  • the method shown in FIG. 6 mainly describes the scheme of using the IP address in the trap target set to trap the host's network access behavior in the process of DNS resolution.
  • the method shown in FIG. 3A or FIG. 5 is used to obtain the IP addresses in the trapping target set for trapping.
  • step 201 in FIG. 2 the process shown in FIG. 6 is executed after step 201 in FIG. 2 and before step 202.
  • Step 600 The forwarding device forwards a DNS domain name request.
  • Step 601 The forwarding device intercepts and stops forwarding a first DNS response message, the first response message indicating that the domain name requested by the DNS domain name request does not exist.
  • a host When a host wants to access a domain name with an unknown IP address, it sends a DNS query message to the DNS server on the network according to the IP address of the DNS server configured inside the host.
  • the DNS query message contains the domain name to be accessed, such as http://www.baidu.com/.
  • the DNS server returns the corresponding DNS response message to the host. If the DNS server finds the IP address corresponding to the requested domain name http://www.baidu.com/ in the DNS data, it will carry the queried IP address in the DNS response message. If the requested domain name does not exist in the DNS database, the DNS response message indicates that the domain name does not exist. For example, by setting the value of the RCODE field in the DNS response message header to 3, it indicates that the requested domain name does not exist.
  • the forwarding device discards the first DNS response message.
  • Step 602 The forwarding device generates a second DNS response message, the second DNS response message includes the IP address corresponding to the domain name queried in the DNS domain name request, and the IP address corresponding to the domain name is in the trap target set Of an unused IP address.
  • the forwarding device caches the DNS domain name request before receiving the first DNS response message, and after receiving the first DNS response message, generates the second DNS response message according to the DNS domain name request.
  • the forwarding device may not cache the DNS domain name request. Instead, after receiving the first DNS response message, it generates a second DNS response message according to the first DNS response message.
  • the second DNS response message The address information of the message is the same as the address information of the first DNS response message, and the second DNS response message indicates that the IP address corresponding to the queried domain name is an IP address in the trap target set.
  • the address information refers to the source IP address, source port number, destination IP address, and destination port number.
  • the forwarding device resets the contents of some fields in the first DNS response message to generate the second DNS response message.
  • the forwarding device sets the value of the RCODE field to 1, indicating that there is no error in the query, and sets the content of the RDATA field of the Answer resource record in the first DNS response message to an IP address in the trap target set, thereby obtaining the second DNS Response message.
  • Step 603 The forwarding device sends the second DNS response message.
  • the host that receives the second DNS response message subsequently initiates access using the IP address in the trapping target set carried in the second DNS response message as the destination requesting access.
  • the forwarding device sends the message of the host's subsequent access to the trapping target through the tunnel to the honeypot management server, thereby achieving trapping of the host's network access behavior.
  • the forwarding device uses the IP address in the trap target set during the DNS resolution process to trap the host's network access behavior, so as to actively trap the DNS detection behavior of potential attackers, which is helpful
  • the network threat trapping system achieves a better trapping effect.
  • Fig. 7 is a schematic structural diagram of a forwarding device provided by an embodiment of the present application.
  • the forwarding device shown in FIG. 7 is used as a network device in the process shown in FIG. 2, FIG. 3A, FIG. 3B, FIG. 4, FIG. 5, or FIG.
  • the forwarding device includes at least one processor 71 and a network interface 73.
  • the forwarding device further includes a memory 72.
  • the processor 71, the memory 72, and the network interface 73 are usually connected to each other through a bus 74, and may also be connected to each other in other ways, for example, through a switching network card.
  • the at least one processor 71 may be one or more CPUs, and the CPU may be a single-core CPU or a multi-core CPU.
  • the memory 72 includes but is not limited to random access memory (RAM), read only memory (ROM), erasable programmable read-only memory, EPROM or flash Memory), ternary content addressable memory (TCAM), flash memory, or optical memory, etc.
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read-only memory
  • TCAM ternary content addressable memory
  • flash memory or optical memory, etc.
  • the code of the operating system is stored in the memory 72.
  • the network interface 73 may be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or a Gigabit Ethernet (GE) interface; the network interface 73 may also be a wireless interface.
  • the network interface 73 is used to receive messages or send messages. Including but not limited to the ARP message, IP message or ICMP message mentioned in the above embodiments.
  • the processor 71 implements the method in the foregoing embodiment by reading the program code stored in the memory 72, or the processor 71 may also implement the method in the foregoing embodiment by using internally stored instructions.
  • the processor 71 implements the method in the foregoing embodiment by reading the program code stored in the memory 72
  • the memory 72 stores the program code that implements the method provided in the foregoing embodiment of the present application.
  • the processor 71 is configured to read the program code stored in the memory 32, and perform the following operations: Obtain a trap target set, the trap target set includes at least one trap target, the at least one trap target includes an unused IP address, or The unopened port number on the used IP address.
  • the network interface 73 receives the first IP packet from the first host.
  • the processor 71 is further configured to determine whether the destination party to which the first IP packet requests access belongs to the trap target set.
  • the network interface 73 is further configured to send the first IP packet to the honeypot management server if the destination to which the first IP packet requests access belongs to the trap target set; and receive the honeypot management server A returned second IP packet, where the second IP packet is a response packet of the first IP packet; and sending the second IP packet to the first host.
  • the forwarding device further includes an input/output interface 75, which is used to connect with an input device and receive configuration information input by a user through the input device.
  • Input devices include but are not limited to keyboards, touch screens, microphones, etc.
  • the input and output interface 75 is also used to connect with an output device, and output the trapping target set determined by the processor 71.
  • Output devices include but are not limited to displays, printers, etc.
  • Fig. 8 is a schematic structural diagram of a network threat trapping device provided by an embodiment of the present application.
  • the network threat trapping device 80 includes a processing module 81, a receiving module 82, and a sending module 83.
  • the processing module 81 is configured to obtain a trapping target set, the trapping target set includes at least one trapping target, and the at least one trapping target includes an unused IP address or an unopened port number on the used IP address;
  • the receiving module 82 is configured to receive the first IP packet from the first host
  • the processing module 81 is further configured to determine whether the destination party to which the first IP packet requests access belongs to the trap target set;
  • the sending module 83 is configured to send the first IP message to the honeypot management server if the destination party to which the first IP message requests access belongs to the trap target set;
  • the receiving module 82 is further configured to receive a second IP packet returned by the honeypot management server, where the second IP packet is a response packet of the first IP packet;
  • the sending module 83 is further configured to send the second IP packet to the first host.
  • the receiving module 82 is further configured to receive a first ARP message, where the first ARP message is an ARP request message.
  • the processing module 81 is further configured to determine the online status of the destination IP address of the first ARP message according to an IP address status table, the IP address status table being used to indicate that the network threat trapping device is connected to the subnet range Corresponding to the online status of the multiple IP addresses, the online status is online or offline; if the online status of the destination IP address of the first ARP message is offline, the first ARP request message The destination IP address of is added to the trapping target set as an unused IP address.
  • the receiving module 82 is further configured to receive a second ARP message, where the second ARP message is an ARP response message or a gratuitous ARP message.
  • the processing module 81 is further configured to determine whether the trapping target set contains the source IP address of the second ARP packet. If the trapping target set contains the source IP address of the second ARP packet, then The source IP address of the second ARP packet that is an unused IP address is deleted from the trap target set.
  • the receiving module 82 is further configured to receive the third IP packet.
  • the processing module 81 is further configured to query the next hop IP address corresponding to the third IP packet in the routing table of the network threat trapping device according to the destination IP address of the third IP packet; if said If the next hop IP address corresponding to the third IP packet does not exist in the routing table, the destination IP address of the third IP packet is added to the trapping target set as an unused IP address.
  • the processing module 81 is further configured to, if the next hop IP address corresponding to the third IP packet exists in the routing table, query the MAC address corresponding to the next hop IP address in the ARP table If the MAC address corresponding to the next hop IP address does not exist in the ARP table, the online status of the destination IP of the third IP packet is determined according to the IP address status table, and the IP address status The table is used to indicate the respective online statuses of multiple IP addresses within at least one subnet to which the cyber threat trapping device is connected, and the online status is online or offline; if the ARP table does not include the download The MAC address corresponding to the one-hop IP address and the online status of the destination IP address of the third IP packet is offline, then the destination IP address of the third IP packet is added as an unused IP address to the Entrap the target collection.
  • the receiving module 82 is further configured to receive a fourth IP packet, where the fourth IP packet is an RST packet.
  • the processing module 81 is further configured to determine whether the fourth IP packet meets a trapping condition, and the trapping condition includes: before receiving the fourth IP packet, at least one corresponding to the fourth IP packet is received SYN packet, the destination IP address of the SYN packet corresponding to the fourth IP packet is the same as the source IP address of the fourth IP packet, and the destination port number is the same as the source port number of the fourth IP packet Same; if the fourth IP packet meets the trapping condition, the source IP address of the fourth IP packet is used as the used IP address, and the source port number of the fourth IP packet is used as the first 4. The unopened port number on the IP address indicated by the source IP address of the IP message is added to the trap target set.
  • the receiving module 82 is further configured to receive a fourth IP packet, where the fourth IP packet is an ICMP unreachable packet.
  • the processing module 81 is further configured to determine whether the fourth IP packet meets a trapping condition, and the trapping condition includes: before receiving the fourth IP packet, at least one corresponding to the fourth IP packet is received A UDP packet, the destination IP address of the UDP packet corresponding to the fourth IP packet is the same as the source IP address of the fourth IP packet, and the destination port number is the same as the source port number of the fourth IP packet the same.
  • the source IP address of the fourth IP packet is used as the used IP address, and the source port number of the fourth IP packet is used as the fourth IP
  • the unopened port number on the IP address indicated by the source IP address of the message is added to the trap target set.
  • the receiving module 82 is further configured to receive a fourth IP packet, where the fourth IP packet is a SYN-ACK packet.
  • the processing module 81 is also used to determine whether the trapping target to be deleted is included in the trapping target set.
  • the trapping target to be deleted is an unopened port number on the used IP address, wherein the used IP address is the
  • the source IP address and the unopened port number of the fourth IP packet are the port numbers indicated by the source port number of the fourth IP packet; if the trapping target set includes the trapping target to be deleted, it will The trapping target to be deleted is deleted from the trapping target set.
  • the receiving module 82 and the sending module 83 are also used to forward DNS domain name requests.
  • the receiving module 82 is further configured to intercept and stop forwarding a first DNS response message, the first DNS response message is a response message for the DNS domain name request, and the first DNS response message indicates the DNS The domain name requested by the domain name request does not exist.
  • the processing module 81 is further configured to generate a second DNS response message, the second DNS response message including the IP address corresponding to the domain name queried in the DNS domain name request, and the IP address corresponding to the domain name is the trap target An unused IP address in the set.
  • the sending module 83 is further configured to send the second DNS response message.
  • the device embodiment described in FIG. 8 is only illustrative.
  • the division of the modules is only a logical function division, and there may be other divisions in actual implementation, for example, multiple modules or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the functional modules in each embodiment of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned various modules in FIG. 8 can be implemented in the form of hardware or software functional units.
  • the above-mentioned receiving module 82, processing module 81, and sending module 83 may be implemented by software functional modules generated after the CPU in FIG. 7 reads the program code stored in the memory.
  • the above modules in FIG. 8 can also be implemented by different hardware in the forwarding device.
  • the receiving module 82 and the sending module 83 are implemented by the network interface 73 in FIG. 7, and the processing module 81 is implemented by the processor 71 in FIG. Or it can be done by using programmable devices such as Field-Programmable Gate Array (FPGA) or coprocessor.
  • FPGA Field-Programmable Gate Array
  • the above functional modules can also be implemented by a combination of software and hardware.
  • the receiving module 82 and the sending module 83 are implemented by hardware programmable devices, and the processing module 81 is generated by the CPU after reading the program code stored in the memory.
  • Software function module is implemented by different hardware in the forwarding device.
  • processing module 81 the receiving module 82, and the sending module 83 in FIG. 8 for implementing the above-mentioned functions, please refer to the descriptions in the previous method embodiments, and will not be repeated here.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种网络威胁的诱捕方法、转发设备和系统。转发设备获得诱捕目标集合，诱捕目标集合中包括诱捕目标，诱捕目标包括未使用的网际协议IP地址、或者已使用的IP地址上未开放的端口号。转发设备接收来自于主机的IP报文，确定IP报文请求访问的目的方是否属于诱捕目标集合。如果IP报文请求访问的目的方属于诱捕目标集合，转发设备向蜜罐管理服务器发送IP报文。转发设备接收蜜罐管理服务器返回的对应IP报文的响应报文；转发设备向主机发送响应报文。这样，主机后续能够与模拟出的请求访问的目的方进行通信，转发设备欺骗主机使其认为网络中存在其请求访问的目的方，该方法降低现有诱捕系统部署代价。

Description

网络威胁的诱捕方法、系统和转发设备
本申请要求于2019年8月22日提交中国国家知识产权局、申请号为201910780575.2、申请名称为“网络威胁的诱捕方法、系统和转发设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机网络安全技术领域，尤其涉及一种网络威胁的诱捕方法、装置、系统和转发设备。
背景技术
随着以高级长期威胁(advanced persistent threat，APT)、勒索病毒为例的下一代威胁的出现，传统的基于特征的安全防御手段难以取得满意的效果。例如，传统的基于特征的安全防御手段无法识别网络中传播的未知恶意软件(例如蠕虫、病毒等等)、攻击者利用社会工程学方式进行的攻击行为、以及利用一个企业、学校或政府的内部网络中的多台主机之间多次跳转实现的攻击行为。
为应对以上问题，有研究提出了基于蜜罐(honeypot)的诱捕系统。蜜罐是对攻击方进行欺骗的技术。蜜罐布置一个或一组作为诱饵的计算机，计算机上开启了一些网络服务或者伪装成存储有高价值数据，从而吸引黑客攻击。蜜罐中还可能装有监控软件，用以监视、捕获恶意软件或黑客入侵作为蜜罐后的行为，以供研究者进行分析或破解。蜜罐可以通过单独的服务器、虚拟机实现，也可以通过软件实现。
为了提高蜜罐的实施效果，诱捕系统在单个蜜罐的基础上增加了网络报文的引流点。典型的诱捕系统逻辑上由一个或多个蜜罐、用于管理蜜罐的蜜罐管理服务器、以及一个或多个代理三部分组成。一个或多个蜜罐可以由虚拟机实现。蜜罐管理服务器用于对一个或多个蜜罐进行管理、以及向代理提供使用蜜罐业务的接口。蜜罐和蜜罐管理服务器可以由同一个计算机实现。代理通常由软件程序实现，代理运行在内部网络的多个主机上，用于将访问该代理所在主机的全部报文、或者访问该代理所在主机指定端口的报文发送给蜜罐管理服务器。
在上述诱捕系统中，需要在大量主机上安装用于实现代理功能的软件程序，部署和维护代价较高。
发明内容
本申请实施例提供一种网络威胁诱捕方法，用以降低现有诱捕系统部署代价。
第一方面，提供了一种网络诱捕方法。在该方法中，转发设备获得诱捕目标集合，所述诱捕目标集合中包括至少一个诱捕目标，所述至少一个诱捕目标包括未使用的网际协议(Internet Protocol，IP)地址、或者已使用的IP地址上未开放的端口号。转发设备接收来自于第一主机的第一IP报文，所述转发设备确定所述第一IP报文请求访问的目的方 是否属于所述诱捕目标集合。如果所述第一IP报文请求访问的目的方属于所述诱捕目标集合，所述转发设备向蜜罐管理服务器发送所述第一IP报文。所述转发设备接收所述蜜罐管理服务器返回的第二IP报文，所述第二IP报文是所述第一IP报文的响应报文，并向所述第一主机发送所述第二IP报文。
在本申请实施例提供的威胁诱捕方案中，一方面，转发设备基于实际网络环境，利用转发设备连接的子网中未使用的地址或端口号，模拟出大量的蜜罐。另一方面，在转发设备上实现诱捕引流点。换句话说，转发设备作为诱捕方案的引流点，在一个主机(潜在的可能被黑客或者恶意软件控制的主机)发起对蜜罐的访问过程中，转发设备创建诱捕目标集合。此后转发设备将请求访问诱捕目标的报文发送给蜜罐管理服务器，并将蜜罐服务器对应返回的报文发送给上述请求的发起方。这样，发起访问的主机后续能够与模拟出的请求访问的目的方进行正常通信，转发设备从而欺骗发起方使其认为网络中存在其请求访问的目的方，并在后续能够与请求访问的目的方进行正常通信。由于内部网络中转发设备的数量通常远小于主机的数量，并且本申请提供的威胁捕获方案无需在内部网络中的主机上安装实现代理功能的软件程序，与在单个真实主机上实现引流的威胁诱捕方案相比，降低了诱捕系统的部署和维护代价。
可选地，转发设备采用一种或多种方法相结合来获得上述诱捕目标集合。在第一方面的一种可能的实现方式中，转发设备在地址解析协议(Address Resolution Protocol，ARP)请求处理过程中获得未使用IP地址，并将未使用IP地址作为诱捕目标加入诱捕目标集合。转发设备接收第一ARP报文，所述第一ARP报文是ARP请求报文。转发设备根据IP地址状态表，确定所述第一ARP报文的目的IP地址的在线状态，所述IP地址状态表用于指示所述转发设备连接的子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线。如果所述第一ARP报文的目的IP地址的在线状态为不在线，则将所述第一ARP请求报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
上述转发设备在ARP请求处理过程中获得的诱捕目标集合用于转发设备后续接收到IP报文时，将目的方属于所述诱捕目标集合的IP报文发送至蜜罐管理服务器，并将蜜罐管理服务器返回的报文发送给发送上述IP报文的主机，从而实现引流点功能。
可以理解的是，第一ARP请求报文的请求方使用的IP地址可以认为是在线的。因此，可选地，在第一方面的另一种可能的实现方式中，转发设备接收第一ARP报文之后，还包括：所述转发设备将所述IP地址状态表中所述第一ARP报文的源IP地址对应的在线状态设置为在线。
可选地，诱捕目标集合中的未使用IP地址有可能后续被分配给内部网络中的主机使用。为了保证主机的正常通信，在此情况下适时更新诱捕目标集合，避免该IP相关的报文被作为诱捕对象而被转发至蜜罐关联服务器。针对这种情况，在第一方面的另一种可能的实现方式中，所述方法还包括：转发设备接收第二ARP报文，所述第二ARP报文是ARP应答报文或者免费ARP报文。所述转发设备判断所述诱捕目标集合中是否包含所述第二ARP报文的源IP地址。如果所述诱捕目标集合中包含所述第二ARP报文的源IP地址，则从所述诱捕目标集合中删除作为未使用的IP地址的所述第二ARP报文的源IP地址。
可选地，与第一ARP报文类似，转发设备接收到第二ARP报文后也可以更新IP地址状态表。在第一方面的另一种可能的实现方式中，所述转发设备接收所述第二ARP报文之后，还包括：所述转发设备将IP地址状态表中所述第二ARP报文的源IP地址对应的在线 状态设置为在线。通过这种方式转发设备可以适时更新IP地址状态表。
可选地，在第一方面的另一种可能的实现方式中，转发设备在IP报文处理过程中获得未使用IP地址，并将未使用IP地址作为诱捕目标加入诱捕目标集合。例如，转发设备在IP报文转发流程中查询路由表、查询ARP表等多个时机在诱捕目标集合中加入诱捕目标。
可选地，在查询路由表的过程中获得诱捕目标包括：转发设备接收第三IP报文，根据所述第三IP报文的目的IP地址，在所述转发设备的路由表中查询所述第三IP报文对应的下一跳IP地址。如果所述路由表中不存在所述第三IP报文对应的下一跳IP地址，则转发设备将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，如果在查询路由表的过程中转发设备确定所述第三IP报文的目的方为诱捕目标，则转发设备向蜜罐管理服务器发送第三IP报文从而对第三IP报文进行诱捕，以便于达到诱骗第三IP报文的发送方的目的。转发设备向所述蜜罐管理服务器发送所述第三IP报文，接收来自于所述蜜罐管理服务器的针对所述第三IP报文的响应报文，并转发所述响应报文。
可选地，转发设备在查询ARP表的过程中获得诱捕目标包括：如果所述路由表中存在所述第三IP报文对应的下一跳IP地址，则所述转发设备在ARP表中查询所述下一跳IP地址对应的媒体访问控制(media access control，MAC)地址。如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址，则所述转发设备根据IP地址状态表，确定所述第三IP报文的目的IP的在线状态，所述IP地址状态表用于指示所述转发设备连接的至少一个子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线。如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第三IP报文的目的IP地址的在线状态为不在线，则所述转发设备将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，如果在查询ARP表的过程中转发设备确定所述第三IP报文的目的方为诱捕目标，则转发设备向蜜罐管理服务器发送第三IP报文从而对第三IP报文进行诱捕，以便于达到诱骗第三IP报文的发送方的目的。转发设备向所述蜜罐管理服务器发送所述第三IP报文，接收来自于所述蜜罐管理服务器的针对所述第三IP报文的响应报文，并转发所述响应报文。
上述转发设备在IP报文处理过程中获得的诱捕目标集合用于转发设备后续接收到IP报文时，将目的方属于所述诱捕目标集合的IP报文发送至蜜罐管理服务器，并将蜜罐管理服务器返回的报文发送给发送上述IP报文的主机，从而实现引流点功能。
可选地，转发设备不仅在上述ARP请求、IP报文的处理过程确定以未使用的IP地址为例的诱捕目标从而获得诱捕目标集合，也可以在处理第一预定类型(连接重置(RST)报文)的IP报文的过程中获得以已使用的IP地址上的未使用的端口号为例的诱捕目标从而获得诱捕目标集合。因此，在第一方面的另一种可能的实现方式中，转发设备接收第四IP报文，所述第四IP报文为RST报文。转发设备判断第四IP报文是否满足诱捕条件，所述诱捕条件包括：在接收到第四IP报文之前，接收到至少一个与所述第四IP报文对应的连接建立(SYN)报文，所述第四IP报文对应的SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四IP 报文满足诱捕条件，则所述转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
可选地，在第四IP报文为RST报文的情况下，设置更为严格的诱捕条件以提高确定诱捕目标的准确性。在第一方面的另一种可能的实现方式中，诱捕条件包括：判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：在接收到第四IP报文之前的预定时间段之前接收到至少一个与所述第四IP报文对应的SYN报文、且在所述预定时间段内接收到的与所述第四IP报文具有相同源IP地址和源端口号的其他报文均为RST报文，所述第四IP报文对应的SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
可选地，在指示请求访问的目的方不可达方面，对于用户数据报协议(User Datagram Protocol，UDP)而言，Internet控制报文协议(Internet Control Message Protocol，ICMP)不可达报文与上述RST报文具有类似的功能。在第一方面的另一种可能的实现方式中，所述转发设备接收第四IP报文，所述第四IP报文为ICMP不可达报文。判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：在接收到第四IP报文之前，接收到至少一个与所述第四IP报文对应的UDP报文，所述第四IP报文对应的UDP报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
可选地，在第四IP报文为ICMP不可达报文的情况下，设置更为严格的诱捕条件以提高确定诱捕目标的准确性。在第一方面的另一种可能的实现方式中，诱捕条件包括：判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：在接收到第四IP报文之前的预定时间段之前接收到至少一个与所述第四IP报文对应的UDP报文、且在所述预定时间段内接收到的与所述第四IP报文具有相同源IP地址和源端口号的其他报文均为ICMP不可达报文，所述第四IP报文对应的UDP报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
可选地，在第一方面的另一种可能的实现方式中，在第四IP报文为RST报文的情况下，如果转发设备确定所述第四IP报文的目的方为诱捕目标，则转发设备向蜜罐管理服务器发送第四IP报文从而对第四IP报文进行诱捕，以便于达到诱骗第四IP报文的发送方的目的。转发设备向所述蜜罐管理服务器发送所述第四IP报文，接收来自于所述蜜罐管理服务器的针对所述第四IP报文的响应报文，并转发所述响应报文。
可选地，在第一方面的另一种可能的实现方式中，上述各种获得诱捕目标的方法可以单独使用，也可以结合使用，例如第二种和第三种获得诱捕目标的方法可以结合使用。例如在第四IP报文为RST报文时，转发设备按照第三种方式处理第四IP报文时，如果所述 第四IP报文不满足诱捕条件，再继续按照第二种方式处理第四IP报文。具体地，如果所述第四IP报文不满足诱捕条件，所述方法还包括：转发设备根据所述第四IP报文的目的IP地址，在所述转发设备的路由表中查询所述第四IP报文对应的下一跳IP地址。如果所述路由表中不存在所述第四IP报文对应的下一跳IP地址，则将所述第四IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，如果所述路由表中不存在所述第四IP报文对应的下一跳IP地址，所述还包括：向所述蜜罐管理服务器发送所述第四IP报文。转发设备接收来自于所述蜜罐管理服务器的所述第四IP报文的响应报文，并向所述第一主机转发所述第四IP报文的响应报文。
可选地，如果所述路由表中存在所述第四IP报文对应的下一跳IP地址，则在ARP表中查询所述下一跳IP地址对应的MAC地址。如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址，则转发设备根据IP地址状态表，确定所述第四IP报文的目的IP的在线状态。如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第四IP报文的目的IP地址的在线状态为不在线，则所述转发设备将所述第四IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第四IP报文的目的IP地址的在线状态为不在线，所述方法还包括：转发设备向所述蜜罐管理服务器发送与所述第四IP报文。接收来自于所述蜜罐管理服务器的针对所述第四IP报文的响应报文，并向所述第一主机转发所述针对所述第四IP报文的响应报文。
上述转发设备在RST报文处理过程中获得的诱捕目标集合用于转发设备后续接收到IP报文时，将目的方属于所述诱捕目标集合的IP报文发送至蜜罐管理服务器，并将蜜罐管理服务器返回的报文发送给发送上述IP报文的主机，从而实现引流点功能。
可选地，在第四IP报文为以连接建立确认(SYN_ACK)报文为例的第二预定类型的IP报文的情况下，转发设备根据第四IP报文的源地址信息确认是否删除诱捕目标集合中的诱捕目标，从而达到更新诱捕目标集合的目的。对应地，在第一方面的另一种可能的实现方式中，上述方法还包括：转发设备接收第四IP报文，所述第四IP报文为SYN-ACK报文。转发设备判断所述诱捕目标集合中是否包括待删除诱捕目标，所述待删除诱捕目标为已使用的IP地址上未开放的端口号，其中，已使用的IP地址为所述第四IP报文的源IP地址、所述未开放的端口号为所述第四IP报文的源端口号指示的端口号。如果所述诱捕目标集合中包括待删除诱捕目标，则所述转发设备从所述诱捕目标集合中删除所述待删除诱捕目标。
可选地，在第一方面的另一种可能的实现方式中，在第四IP报文为SYN-ACK报文的情况下，转发设备根据第四IP报文的源地址信息更新诱捕目标集合后，仍然可以按照上述获得诱捕目标的第二种方法确定SYN-ACK报文的目的方是否为诱捕目标。在第四IP报文为SYN-ACK报文的情况下，转发设备接收第四IP报文之后，所述方法还包括：所述转发设备根据所述第四IP报文的目的IP地址，在所述转发设备的路由表中查询所述第四IP报文对应的下一跳IP地址。如果所述路由表中不存在所述第四IP报文对应的下一跳IP地址，则将所述第四IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，在第四IP报文为SYN-ACK报文的情况下，如果所述路由表中不存在所述第四IP报文对应的下一跳IP地址，所述方法还包括：向所述蜜罐管理服务器发送所述第四IP报文。接收来自于所述蜜罐管理服务器的所述第四IP报文的响应报文，并向所述第一 主机转发所述第四IP报文的响应报文。如果所述路由表中存在所述第四IP报文对应的下一跳IP地址，则在ARP表中查询所述下一跳IP地址对应的MAC地址。如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址，则转发设备根据IP地址状态表，确定所述第四IP报文的目的IP的在线状态，所述IP地址状态表用于指示所述转发设备连接的至少一个子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线。如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第四IP报文的目的IP地址的在线状态为不在线，则所述转发设备将所述第四IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，在第四IP报文为SYN-ACK报文的情况下，如果转发设备根据第二种方式处理第四IP报文的过程中确定所述第四IP报文的目的方为诱捕目标，则转发设备向蜜罐管理服务器发送第四IP报文从而对第四IP报文进行诱捕，以便于达到诱骗第四IP报文的发送方的目的。即，如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第四IP报文的目的IP地址的在线状态为不在线，转发设备向所述蜜罐管理服务器发送所述第四IP报文，接收来自于所述蜜罐管理服务器的针对所述第四IP报文的响应报文，并转发所述响应报文。
上述转发设备在SYN-ACK报文处理过程中更新诱捕目标集合，能够提高后续基于诱捕目标集合实现IP报文诱捕的准确性，避免在原有诱捕目标集合中的IP地址被分配给一个主机使用后，影响该主机的正常通信。
可选地，在第一方面的另一种可能的实现方式中，转发设备利用ARP探测，确定子网访问内各个IP地址分别对应的在线状态，从而形成IP地址状态表。即，转发设备针对所述转发设备连接的子网范围内的多个IP地址中的每个IP地址分别发送ARP请求报文。转发设备未接收到针对第一IP地址的ARP响应报文，将所述第一IP地址添加到所述IP地址状态表中，所述第一IP地址为所述多个IP地址中的IP地址；并将所述第一IP地址的状态设置为不在线。转发设备接收到针对第二IP地址的ARP响应报文，所述第二IP地址为所述多个IP地址中的IP地址；将所述第二IP地址添加到所述IP地址状态表中；并将所述第二IP地址的状态设置为在线。通过这种方式，转发设备可以维护一个IP地址状态表，以便于基于该IP地址状态表确定捕获目标集合。
可选地，在第一方面的另一种可能的实现方式中，转发设备转发域名系统(Domain Name System，DNS)域名请求。所述转发设备截获并停止转发第一DNS响应报文，所述第一DNS响应报文是针对所述DNS域名请求的响应报文，所述第一响应报文指示所述DNS域名请求所查询的域名不存在。所述转发设备生成第二DNS响应报文，所述第二DNS响应报文包括所述DNS域名请求所查询的域名对应的IP地址，所述域名对应的IP地址为所述诱捕目标集合中的一个未使用的IP地址。所述转发设备发送所述第二DNS响应报文。转发设备通过对潜在的攻击者的DNS探测行为进行诱捕，有助于达到更佳的诱捕效果。
可选地，在上述第一方面、或第一方面的任意一种可能的实现方式中，所述诱捕目标集合表示为诱捕目标表，所述诱捕目标表中包括至少一个表项，所述至少一个表项中的每个表项用于指示一个所述诱捕目标，所述每个表项包括一个IP地址用以指示未使用的IP地址、或者包括一个IP地址与端口号的组合用以指示已使用的IP地址上未开放的端口号。转发设备确定所述第一IP报文请求访问的目的方是否属于诱捕目标集合，包括：所述转发设备确定所述诱捕目标表中是否存在一个表项包括所述第一IP报文的目的IP地址、或 者包括所述第一IP报文的目的IP地址与目的端口号的组合。如果所述诱捕目标表存在一个表项包括所述第一IP报文的目的IP地址、或者包括所述第一IP报文的目的IP地址与目的端口号的组合，则确定所述第一IP报文请求访问的目的方属于所述诱捕目标集合。如果所述诱捕目标表不存在一个表项包括所述第一IP报文的目的IP地址、并且不存在一个表项包括所述第一IP报文的目的IP地址与目的端口号的组合，则确定所述第一IP报文请求访问的目的方不属于所述诱捕目标集合。
转发设备以诱捕目标表的方式保存诱捕目标集合，有助于后续接收到IP报文后，基于该诱捕目标表确定IP报文请求访问的目的方是否属于所述诱捕目标集合，提高捕获效率。
第二方面，提供了一种网络威胁诱捕装置，该网络威胁诱捕装置具有实现上述第一方面、或上述第一方面的任意一种可能的实现方式所述方法的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
第三方面，提供了一种转发设备，该转发设备包括网络接口和至少一个处理器。所述网络接口用于接收或发送报文。所述至少一个处理器与网络接口连接，执行上述第一方面或第一方面的任意一种可能的实现方式中的方法，具体参见上面的详细描述，此处不再赘述。
第四方面，提供了一种网络威胁诱捕系统，包括蜜罐管理服务器以及至少一个转发设备。所述至少一个转发设备中的每个转发设备执行上述第一方面或第一方面的任意一种可能的实现方式中的方法，具体参见上面的详细描述，此处不再赘述。
第五方面，提供了一种计算机可读存储介质，用于储存为上述转发设备所用的计算机软件指令，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意一种可能的实现方式中所述的方法。
第六方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意一种可能的实现方式中所述的方法。
第七方面，本申请实施例提供了一种芯片，包括存储器和处理器，存储器用于存储计算机指令，处理器用于从存储器中调用并运行该计算机指令，以执行上述第一方面及其第一方面任意可能的实现方式中的方法。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为是本申请实施例提供的网络威胁的诱捕系统的应用场景示意图；
图2为本申请实施例提供的威胁的诱捕方法的原理流程图；
图3A为本申请实施例提供的一种创建诱捕目标集合的方法的流程图；
图3B为本申请实施例提供的一种获得IP地址状态表的方法流程图；
图4为本申请实施例提供的另一种创建诱捕目标集合的方法的流程图；
图5为本申请实施例提供的另一种创建诱捕目标集合的方法的流程图；
图6为本申请实施例提供的一种在DNS解析的过程中实施诱捕的方案的流程图；
图7为本申请实施例提供的一种转发设备的结构示意图；
图8为本申请实施例提供的一种网络威胁的诱捕装置的结构示意图。
具体实施方式
有的诱捕系统需要在内部网络的主机上安装用以实现代理功能的软件程序。代理作为蜜罐的引流点，将访问该代理所属主机指定端口的报文发送给蜜罐管理服务器。一方面，当代理数目过少时，蜜罐能实现的诱捕效果有限。另一方面，在大量主机上安装软件程序这一方式的部署和维护代价很高。
本申请实施例提供了一种网络威胁诱捕系统，该系统包括转发设备和蜜罐管理服务器。该系统在诱捕对象和引流点这两方面相对于现有技术有重要改进。一方面，内部网络中的转发设备(在后续实施例中为了简明起见，简称为“转发设备”)首先基于实际网络环境，利用内部网络中未使用的地址或未开放的端口，模拟出大量的蜜罐(这里的“蜜罐”意指不存在的、请求访问的目的方地址资源)。另一方面，转发设备实现引流点，即转发设备将请求访问被模拟出的蜜罐的报文发送给蜜罐管理服务器，并将蜜罐服务器对应返回的IP报文发送给上述请求的发起方，从而实现对于网络威胁的捕获过程。由于内部网络中转发设备的数量通常远小于主机的数量，并且本申请提供的威胁捕获方案无需在内部网络中的主机上安装实现代理功能的软件程序，与在单个真实主机上实现引流的威胁诱捕方案相比，降低了诱捕系统的部署和维护代价。
下面结合各个附图对本申请实施例技术方案的主要实现原理、具体实施方式及其对应能够达到的有益效果进行详细的阐述，方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。
附图1是本申请实施例提供的网络威胁诱捕系统的应用场景示意图。网络威胁诱捕系统应用于内部网络。在本申请实施例中内部网络包括公司、学校、政府部门等组织的局域网，或者一个组织内部通过虚拟专用网(Virtual Private Network，VPN)连接的多个局域网。内部网络中包含多个主机，如主机101和主机102、一个蜜罐服务器120和至少一个转发设备，如转发设备110和转发设备111。
图1中的主机101和主机102可以是个人计算机、笔记本电脑等等。主机101的IP地址是1.1.1.101，主机102的IP地址是1.1.1.102，主机101和主机102属于同一子网中1.1.1.1-1.1.1.255。
主机101和主机102通过转发设备110连接。可选地，转发设备110是三层交换机。三层交换机是一个带有第三层(网络层)路由功能和第二层(数据链路层)交换功能的交换机。三层交换机基于MAC表对二层流量进行转发。三层交换机基于路由表对三层流量实现“一次查表(路由表)，多次转发”。三层交换机基于IP地址对来自于不同子网的两个主机之间的第一个数据包进行三层路由后，通过ARP学习机制获得目的主机的MAC地址，并产生一个MAC地址与IP地址的映射关系，并在地址解析协议(Address Resolution Protocol，ARP)表中存储该映射关系。转发设备110也可以是路由器或网关设备，在这里不进行具体限定。
转发设备110连接有至少一个子网。如果主机101和主机102属于同一子网，则主机 101和主机102之间的报文可以进行二层交换。如果主机101和主机102属于不同子网，则二者之间的报文需要通过三层路由进行转发。
可选地，转发设备110与蜜罐服务器120之间建立隧道，例如用户数据报协议(User Datagram Protocol，UDP)隧道、可扩展虚拟局域网(Virtual eXtensible LAN，VXLAN)隧道、通用路由封装(Generic Routing Encapsulation，GRE)隧道等。例如，转发设备110使用IP地址2.2.2.1、端口号1234与蜜罐管理服务器120建立隧道，蜜罐管理服务器120使用IP地址2.2.2.2、端口号1234与转发设备110建立隧道。
转发设备110通过隧道封装，将请求方发送的、目的方为捕获目标的报文发送给蜜罐管理服务器，对应地，转发设备110通过隧道接收蜜罐管理服务器返回的报文，对接收到的报文解封装得到其中封装的蜜罐主机回应的报文，将解封装得到的报文发送给请求方。通过这种方式，转发设备110和蜜罐服务器120进行协作，以便于蜜罐主机模拟捕获目标与报文的请求方进行交互。
蜜罐管理服务器120用于对一个或多个蜜罐(蜜罐主机)进行管理、以及向蜜罐业务的客户提供使用蜜罐业务的接口。蜜罐管理服务器120还用于对蜜罐业务进行管理。可选地，蜜罐管理服务器120管理至少一个蜜罐主机。随着蜜罐服务需求量的增长、以及为了满足越来越高的对服务质量的需求，蜜罐管理服务器120管理多个蜜罐主机，多个蜜罐主机可以互为备份、以及实现负载均衡。图1为例，蜜罐管理服务器120管理有3个蜜罐主机，即蜜罐主机1、蜜罐主机2和蜜罐主机3。可选地，由多个虚拟机分别实现3个蜜罐主机。每个蜜罐主机都有相应的IP地址，例如，蜜罐主机1的IP地址是172.1.1.1，蜜罐主机2的IP地址是172.1.1.2，蜜罐主机3的IP地址是172.1.1.3。
蜜罐管理服务器120根据预定算法，将通过隧道接收到的报文(即隧道报文中封装的内层报文)的目的IP地址和目的端口号映射到3个蜜罐主机中的一个蜜罐主机；根据映射结果执行第一次替换，即将通过隧道接收的报文的目的IP地址和目的端口号替换为映射的蜜罐主机的IP地址和映射的蜜罐主机的端口号；并将替换生成的报文发送给映射的蜜罐主机。例如，捕获目标包括内部网络中子网中的未使用IP地址1.1.1.105。转发设备110将主机101访问IP地址1.1.1.105上端口号80的报文(记为message 1)经隧道封装后发送蜜罐服务器。蜜罐服务器根据端口号80映射到蜜罐主机1。蜜罐管理服务器将message 1的目的IP地址替换为蜜罐主机1的IP地址是172.1.1.1，目的端口号仍然为80，从而生成报文message 1’。蜜罐管理服务器将替换生成的报文message 1’发送给蜜罐主机1。在本实施例中以蜜罐服务器120仅对通过隧道接收到的报文的目的IP地址进行了替换为例进行说明。除此之外，蜜罐服务器120还可以对通过隧道接收到的报文的目的IP地址和端口号均进行替换，原理与仅替换目的IP地址基本类似，在这里不再进行举例说明。
在相反的方向上，蜜罐管理服务器120接收到蜜罐主机返回的报文后，根据映射结果执行第二次替换，即将蜜罐主机返回的报文的源IP地址和源端口号替换为第一次替换之前隧道接收到的报文的目的IP地址和目的端口号。并将第二次替换生成的报文通过隧道发送给转发设备。仍然参考上面的例子，蜜罐管理服务器120接收蜜罐主机1针对message 1返回的报文(记为message 2)，将message 2的源IP地址替换为1.1.1.105，源端口号仍然为80。将替换生成的报文message 2’通过隧道发送给转发设备110。
可选地，上述映射和替换的功能可以如上所述集中在蜜罐管理服务器执行，也可以由 多个转发设备分布式地执行。即，上述对message 1的目的地址和目的端口号进行映射，以及根据映射结果对message 1和message 2执行地址和端口号的替换的功能也可以由转发设备来执行。具体地，转发设备110对message 1执行替换后将替换生成的报文message 1’通过隧道发送给蜜罐管理服务器，并对蜜罐服务器通过隧道发送的message 2执行地址和端口的替换后，将替换生成的报文message 2’发送给主机101。
在实际应用中，由于蜜罐管理服务器可能同时与多个转发设备建立隧道，并提供蜜罐服务，因此由蜜罐管理服务器集中执行上述映射和替换的功能更有优势。这样便于蜜罐管理服务集中实施，例如增加或者减少蜜罐主机的数目，以及更新用于将报文的目的IP地址和目的端口号映射到其中一个蜜罐主机的算法等等。然而在另一方面，由多个转发设备分布式执行上述映射和替换的功能的方式能避免蜜罐管理服务器成为性能瓶颈。因此集中式和分布式执行映射和替换的功能的这两种方式各有优势，网络管理人员可以根据实际情况选择性实施。
下面将结合附图1所示的应用场景，对本申请实施例提供的网络威胁诱捕方法进行说明。附图2是本申请实施例提供的威胁诱捕方法的原理流程图。附图2主要从转发设备的角度对本申请实施例提供的网络威胁诱捕方法进行说明。可选地，附图2中的转发设备可以是附图1中的转发设备110。
步骤201，转发设备获得诱捕目标集合。诱捕目标集合中包括至少一个诱捕目标，至少一个诱捕目标包括未使用的IP地址、或者已使用的IP地址上未开放的端口号。也就是说，至少一个诱捕目标中既可以全部是未使用的IP地址、全部是已使用的IP地址上未开放的端口号，也可以部分为未使用的IP地址、且其余部分为已使用的IP地址上未开放的端口号。诱捕目标所涉及的IP地址是转发设备连接的至少一个子网范围内的IP地址。
在本申请实施例中，未使用的IP地址是相对于已使用的IP地址而言的，未使用的IP地址是指未被配置给内部网络中任何一台主机的IP地址。已使用的IP地址是指已被配置给一台主机的IP地址。诱捕目标中涉及的端口号是指计算机设备上的逻辑端口号。未开放的端口号是指主机未使用该端口号向网络中的其他主机提供服务。
可选地，为了便于信息存储、查找和匹配，诱捕目标集合用诱捕目标表来表示。诱捕目标表中包括至少一个表项，所述至少一个表项中的每个表项用于指示一个诱捕目标，所述每个表项包括一个IP地址、或者一个IP地址与端口号的组合。表1是诱捕目标表的示例，表1所示的诱捕目标表中包含2个表项。表项1指示的诱捕目标为IP地址1.1.1.103上未开放的端口80，表项2指示的诱捕目标为未使用的IP地址1.1.1.105。
表1
Figure PCTCN2020110656-appb-000001
获得诱捕目标集合的具体方式可以有多种。可选地，当内部网络使用静态配置的方式分配IP地址时，转发设备通过输入接口接收网络管理员输入的未使用的IP地址，转发设备的输入接口与以键盘为例的输入设备连接。当内部网络使用动态地址分配方案时，动态主机设置协议(英语：Dynamic Host Configuration Protocol，DHCP)服务器为网络中 的主机分配IP地址，转发设备从DHCP服务器获得未使用的IP地址。
可选地，本申请实施例还提供了多种转发设备通过主动学习的方式获得诱捕目标集合的实施例，将在后面的实施例中结合附图进行详细说明。
步骤202，转发设备接收第一IP报文，第一IP报文来自于第一主机。以转发设备是附图1中的转发设备110为例来举例说明。第一主机是附图1中的主机101。第一报文的源IP地址为主机101的IP地址1.1.1.101。
步骤203，转发设备确定第一IP报文请求访问的目的方是否属于诱捕目标集合。请求访问的目的方用目的IP地址、或目的IP地址和目的端口号的组合来指示。具体地，转发设备对第一IP报文进行IP头解析，从而获得第一IP报文的目的IP地址、或者第一IP报文的目的IP地址和目的端口号的组合。转发设备将获得的第一IP报文的目的IP地址、或者第一IP报文的目的IP地址和目的端口号的组合分别与表1所示的诱捕目标表中的表项进行比较，如果与其中一个表项内容相同，则确定第一IP报文请求访问的目的方属于诱捕目标集合，执行步骤204。如果与其中任何一个表项内容均不相同，则确定第一IP报文请求访问的目的方不属于诱捕目标，按照第一报文的目的IP地址查询路由表、或者查询ARP表和路由表找到对应的接口号，用对应的接口将第一报文发送出去。根据路由表转发报文的过程为现有交换机功能，在这里不再详述。
步骤204，转发设备向蜜罐管理服务器发送所述第一IP报文。可选地，转发设备通过转发设备与蜜罐管理服务器之间的隧道，向蜜罐管理服务器发送所述第一IP报文。具体地，通过隧道发送第一IP报文是指基于预先建立的隧道的参数和隧道协议类型对第一IP报文进行封装。即转发设备将第一IP报文作为隧道报文的载荷部分，对第一IP报文添加隧道协议报文头，从而生成第一隧道报文，向蜜罐管理服务器发送第一隧道报文。
可选地，转发设备和蜜罐管理服务器基于多种不同协议建立二者之间的隧道，转发设备和蜜罐管理服务器之间的隧道包括但不限于UDP隧道、VXLAN隧道、GRE隧道等。
步骤205，转发设备接收蜜罐管理服务器返回的第二IP报文。可选地，转发设备通过上述隧道接收第二IP报文，所述第二IP报文是蜜罐管理服务器返回的所述第一IP报文的响应报文。具体地，通过隧道接收第二IP报文是指基于隧道的参数和隧道协议类型对蜜罐服务器返回的第二隧道报文进行解封装，获取第二隧道报文载荷部分中包括的第二IP报文。
步骤206，转发设备向第一主机发送第二IP报文。
以附图1中的主机101为例，假定主机101被黑客控制或者被网络病毒感染后，以主机101作为跳板对内部网络中的其他主机进行探测或攻击。例如利用主机101对内部网络中的其他主机进行扫描，尝试获取另一主机的信息，进而试图登录另一主机，从而达到获取另一主机上保存的敏感信息或者利用另一主机上的漏洞达到其他攻击目的。主机101向同一子网中的另一IP地址1.1.1.103发送IP报文(记为message 1)。message 1的源IP地址为主机101的IP地址1.1.1.101，端口号为1000，目的IP地址为1.1.1.103，目的端口号为80。
转发设备110接收到message 1后，根据message 1的目的IP地址和目的端口号查找表1所示的诱捕目标表，确定message 1的目的IP地址和目的端口号的组合与表项1的内容相同，因此message 1请求访问的目的方属于诱捕目标。
转发设备110通过与蜜罐管理服务器120之间的隧道对message 1进行封装，添加隧 道协议报文头，从而生成一个隧道报文(记为message 1X)，message 1被携带在message 1X的载荷部分。message 1X隧道协议报文头中的源IP地址为交换机110的IP地址2.2.2.1，源端口号为交换机110上的端口号1234，message 1X隧道协议报文头中的目的IP地址为蜜罐管理服务器120的IP地址2.2.2.2，目的端口号为蜜罐管理服务器120的端口号1234。
蜜罐管理服务器120中保存有预定的算法。预定的算法的作用是分配一个蜜罐主机用以处理message 1。可选地，在本实施例中，预定的算法是根据预先设置的端口号和蜜罐主机标识的对应关系，将访问端口号80的报文分配给蜜罐主机1进行处理。
蜜罐管理服务器120接收到message 1X后，对message 1X解封装，获得message 1X载荷部分中的message 1。蜜罐管理服务器120根据预定的算法，根据message 1的目的端口号80映射到蜜罐主机1。蜜罐管理服务器120将message 1的目的IP地址替换为蜜罐主机1的IP地址是172.1.1.1，生成替换后的报文，记为message 1’。蜜罐管理服务器120记录替换前的目的IP地址1.1.1.101与替换后的目的IP地址172.1.1.1的对应关系，目的端口号保持不变。蜜罐管理服务器120将message 1’发送给蜜罐主机1。
蜜罐管理服务器120接收蜜罐主机1针对message 1’返回的响应报文message 2。message 2的源地址是蜜罐主机1的IP地址是172.1.1.1、源端口号为80。蜜罐管理服务器120根据此前记录的对应关系，将message 2的源IP地址由172.1.1.1替换为1.1.1.103，从而生成替换后的报文，记为message 2’。蜜罐管理服务器120通过与转发设备110之间的隧道对message 2’进行封装，添加隧道协议报文头，从而生成一个隧道报文(记为message 2X)，message 2’被携带在message 2X的载荷部分。message 2X隧道协议报文头中的目的IP地址为转发设备110的IP地址2.2.2.1，目的端口号为转发设备110上的端口号1234，message 2X隧道协议报文头中的源IP地址为蜜罐管理服务器120的IP地址2.2.2.2，源端口号为蜜罐管理服务器120的端口号1234。
转发设备110接收到message 2X后，对message 2X解封装，获得message 2X载荷部分中的message 2’。交换机根据message 2’的目的IP地址1.1.1.101向主机101发送message 2’。这样，从主机101的角度来看，可以与蜜罐主机1虚拟出具有IP地址1.1.1.103和开放了端口80的主机正常通信。
根据本申请实施例提供的威胁诱捕方案，内部网络中以交换机为例的转发设备基于实际网络环境，利用转发设备连接的子网中未使用的地址或端口，模拟出大量的蜜罐。转发设备作为诱捕方案的引流点，当内部网络中的一个主机(潜在的可能被黑客或者恶意软件控制的主机)发起对蜜罐的访问时，转发设备创建诱捕目标集合。此后转发设备将请求访问诱捕目标的报文发送给蜜罐管理服务器，并将蜜罐服务器对应返回的报文发送给上述请求的发起方。这样诱捕系统欺骗发起方使其认为网络中存在其请求访问的目的方，并在后续能够与请求访问的目的方进行正常通信，以便于诱捕系统在通信过程中获取黑客或恶意软件的行为，一方面供研究者进行分析或破解，另一方面延缓对内部网络其他主机的入侵，从而实现对于网络威胁的捕获过程。
本申请实施例提供的威胁诱捕方案主要由转发设备实施，无需在内部网络的主机中设置代理，因此降低了诱捕系统的部署和维护代价。另一方面，申请实施例提供的威胁诱捕方案利用实际网络中空闲地址资源实现蜜罐，避免对内部网络中正常业务的造成影响。
下面将结合几个不同的实施例，对转发设备根据实际网络环境，创建诱捕目标集合、以及维护诱捕目标的具体方式进行说明。这些实施例所示的方式可以相互结合、或者部分 步骤进行等同替换，而获得更多的实施例。需要说明的是，转发设备根据实际网络环境创建诱捕目标集合的方式包括但不限于以下几种。
本申请实施例主要介绍三种转发设备根据实际网络环境创建诱捕目标集合的方式。第一种方式是转发设备在处理通信请求方发起的ARP请求过程中，获取诱捕目标并将诱捕目标加入诱捕目标集合。第二种方式是转发设备在执行IP报文转发流程中，获取诱捕目标并将诱捕目标加入诱捕目标集合。第三种方式是转发设备在处理通信请求方在建立IP会话阶段的第一预定类型报文过程中，获取诱捕目标并将诱捕目标加入诱捕目标集合。第一预定类型报文包括RST报文或者ICMP不可达报文。除此之外，可选地，转发设备还可以在处理第二预定类型报文时删除诱捕目标集合中的诱捕目标，以达到更新诱捕目标集合的目的，第二预定类型的报文为SYN-ACK报文。
可选地，转发设备在创建诱捕目标集合时，可以选择使用一种创建诱捕目标集合的方式来创建创建诱捕目标集合，也可以选择性将多种创建诱捕目标集合的方式结合使用来创建创建诱捕目标集合、也选择是否与上述更新诱捕目标集合的方式结合使用来创建创建诱捕目标集合。网络管理员可以根据实际网络需求以及多因素考虑来配置创建诱捕目标集合时采用的具体方案。
附图3A是本申请实施例提供的一种创建诱捕目标集合的方法的流程图。附图3A主要对上述第一种根据实际网络环境创建诱捕目标集合的方式进行描述，即转发设备在处理通信请求方发起的ARP请求过程中获取诱捕目标并将诱捕目标加入诱捕目标集合。
步骤300，转发设备接收一个ARP报文。
ARP是将IP地址解析为MAC地址(或称为物理地址)的协议。在局域网中，当主机或其他网络设备有数据要发送给另一个主机时，数据发送方需要同时知晓数据接收方的IP地址和MAC地址，将IP报文封装成二层以太帧才能通过以太网传输。ARP用于实现IP地址到MAC地址的映射。
ARP报文的长度为42字节，前14字节为二层(以太网)报文头，携带有源MAC地址、目的MA地址和帧类型。后28字节中的操作类型(op)字段用于识别一个ARP报文是ARP请求报文还是ARP响应报文。具体地，op字段内容1为ARP请求，2为ARP响应，3为RARP请求，4为RARP响应。
ARP请求报文和ARP响应报文的作用是学习通信对端对应的ARP表项。如果两台主机(主机A和主机B)处于同一子网，主机A向主机B发送信息的过程包括以下步骤。主机A根据主机B的IP地址查找主机A上的ARP表，确定主机A上的ARP表中是否包含主机B对应的ARP表项，主机B对应的ARP表项中包括主机B的IP地址和主机B的MAC地址。如果查找到主机B的对应的ARP表项，则从查找到的表项中得到主机B的MAC地址。将主机B的MAC地址作为目的MAC地址，将IP报文封装成以太帧后发送给主机B。如果查找不到主机B的对应的ARP表项，则以广播方式发送一个ARP请求报文。ARP请求报文中的源IP地址和源MAC地址分别是主机A的IP地址和主机A的MAC地址。目的IP地址和目的MAC地址分别是主机B的IP地址和全F的MAC地址(FFFF.FFFF.FFFF.FFFF)。子网中的所有主机都会接收到ARP请求报文。主机B比较自身的IP地址和ARP请求报文中的目的IP地址相同，则一方面将ARP请求报文的源IP地址和源MAC地址存入自身的ARP表中，另一方面生成ARP响应报文，ARP响应报文中包含主机B的MAC地址，以单播方式向主机A发送ARP响应报文。
如果主机A和主机B处于不同子网，则需要通过网关来发送报文。主机A先将报文发送给网关，再经由网关将报文发送给主机B。如果网关保存的ARP表中不存在主机B的ARP表项，则会广播目的IP地址为主机B的IP地址的ARP请求报文，并从对应的ARP响应报文中得到主机B的MAC地址。
可见无论主机A和主机B是否处于同一子网，当主机B最初作为请求访问的目的方时，主机A或网关均会发送目的IP地址为主机B的IP地址的ARP请求报文。
免费ARP报文是指报文中的源IP地址和目的IP地址相同的报文。免费ARP报文主要有两个用途：一是发送该免费ARP报文的设备向周边其他设备通告本设备的ARP信息，使其他设备学习到包含本设备的的IP地址和MAC地址的ARP表项，以便于后续发送信息时，不用重新请求ARP；二是检测IP地址冲突，如果发送该免费ARP报文的设备收到了针对免费ARP报文的响应报文，说明本设备的IP地址被其他设备占用了。一个主机可以在MAC地址变更或者IP地址变更时发送免费ARP报文。
步骤301，转发设备判断该ARP报文的类型是ARP请求报文、ARP响应报文、还是免费ARP报文。如果是ARP请求报文，则执行步骤302。如果是ARP响应报文、或是免费ARP报文，则执行步骤306。
转发设备根据ARP报文的op字段可以识别出ARP报文是ARP请求报文、还是ARP响应报文。通过比较ARP报文的源IP地址和目的IP地址是否相同可以确定ARP报文是否是免费ARP报文。如果ARP报文的源IP地址和目的IP地址相同，则确认是免费ARP报文。
步骤302，转发设备根据IP地址状态表，确定所述ARP报文的目的IP地址的在线状态。所述IP地址状态表用于指示所述转发设备连接的至少一个子网范围内的多个IP地址的在线状态，所述在线状态为在线或不在线。
可选地，IP地址状态表可以仅保存在线状态为不在线的IP地址，也可以同时保存在线状态为在线的IP地址以及在线状态为不在线的IP地址。如果IP地址状态表可以仅保存在线状态为不在线的IP地址，则IP地址状态表可以仅保存IP地址，默认IP状态表中包含的IP地址的状态为不在线。如果IP地址状态表同时保存在线状态为在线的IP地址以及在线状态为不在线的IP地址，在IP地址状态表需要保存IP地址、以及每个IP地址对应的在线状态。
可选地，以两个IP地址为例，对IP地址状态表的获取过程进行描述。第一IP地址和第二IP地址分别为转发设备连接的子网中的多个IP地址中的两个IP地址。IP地址状态表通过以下步骤获得：转发设备针对所述转发设备连接的子网范围内的多个IP地址中的每个IP地址分别发送ARP请求报文；转发设备如果未接收到针对第一IP地址的ARP响应报文，将所述第一IP地址添加到所述IP地址状态表中，所述第一IP地址为所述多个IP地址中的IP地址；并将所述第一IP地址的状态设置为不在线。可选地，在IP地址状态表同时保存在线状态为在线的IP地址以及在线状态为不在线的IP地址的情况下，转发设备如果接收到针对第二IP地址的ARP响应报文，将第二IP地址添加到所述IP地址状态表中，所述第二IP地址为所述多个IP地址中的IP地址；并将所述第二IP地址的状态设置为在线。
在实际网络场景下，主机可能因临时故障而无法及时响应ARP请求报文。可选地，为了在这种场景下避免错误地将临时性偶发故障的主机使用的IP地址加入捕获目标集合，转发可以多次向一个IP地址发送ARP请求报文，在满足预定条件(例如预定时长、或者 预定连续数量的发送周期等等)未收到对应的ARP响应报文时，才将所请求的IP地址加入捕获目标集合。如图3B所示，IP地址状态表通过步骤3021～步骤3025获得。
转发设备连接有至少一个子网，每个子网都包含多个IP地址。转发设备对这些子网范围内的一个IP地址，执行步骤3021～步骤3025，从而获得这个IP地址的在线状态。转发设备对子网范围内的多个IP地址，均执行类似的过程，从而获得指示多个IP地址的在线状态的IP地址状态表。
为了便于描述，本申请实施例以获得一个IP地址(即选择出的IP地址)对应的状态为例进行说明。可选地，转发设备根据子网类型，构建一个子网对应的IP地址空间表，IP地址空间表中包括子网中每个IP地址。针对IP地址空间表中的每个IP地址均执行类似的步骤以获得在线状态。在实施过程中，转发设备可以定期(例如，每天0:00-1:00)从IP地址空间表中顺序读取每个IP地址，对读取的每个IP地址执行广播ARP请求报文，基于ARP响应报文确定在线状态，也可以以其他方式读取每个IP地址，只要保证对每个IP地址执行步骤3021～步骤3025获得对应的在线状态即可。
转发设备针对连接的至少一个子网范围内的至少一个IP地址中选择一个IP地址，对选择出的IP地址执行以下处理，直到对所述至少一个IP地址均执行以下操作为止。
步骤3021，转发设备在预定探测周期到达时发送ARP请求报文，所述ARP请求报文的目的IP地址为所述选择出的IP地址。可选地，转发设备通过一个计时器实现按照预定周期广播ARP请求报文。可选地，探测周期可以设置为1秒或者0.1秒等等。显然探测周期不宜设置过长，应远小于上述1小时为例的检测时段。
步骤3022，转发设备在本周期结束之前记录是否接收到针对所述ARP请求报文的响应报文。
转发设备针对每个周期，记录是否接收到对应的ARP响应报文。假定在一个周期中，如果转发设备在本周期结束之前接收到针对所述ARP请求报文的响应报文，则执行步骤3023，如果在本周期结束之前未接收到针对所述ARP请求报文的响应报文，执行步骤3024。
步骤3023，转发设备在IP状态表中将所述选择出的IP地址的状态设置为在线。返回步骤3021。
步骤3024，转发设备根据记录的各周期中是否接收到ARP响应报文的情况，判断未接收到针对所述ARP请求报文的响应报文的连续周期的数目(例如10个周期)是否超过预定值。如果未接收到针对所述ARP请求报文的响应报文的连续周期的数目未超过预定值，则执行步骤3023，暂时将选择出的IP地址的状态设置为在线，如果未接收到针对所述ARP请求报文的响应报文的连续周期的数目已超过预定值，执行步骤3025。
步骤3025，转发设备在IP状态表中将所述选择出的IP地址的状态设置为不在线，并返回步骤3021。
基于步骤3021～步骤3025生成的IP地址状态表，转发设备如果确定ARP报文的目的IP地址的在线状态为在线，则按照已有ARP报文转发流程，对该ARP报文进行转发。如果确定该ARP报文的目的IP地址的在线状态为不在线，则执行步骤303。
步骤303，如果步骤300接收的ARP报文的目的IP地址的在线状态为不在线，则转发设备将所述ARP请求报文的目的IP地址作为未使用的IP地址加入诱捕目标集合。
可选地，在使用表1所示的诱捕目标表存储诱捕目标集合的情况下，转发设备创建一个表项。所创建的表项中包含所述ARP请求报文的目的IP地址。转发设备进一步将所创 建的表项加入诱捕目标表。
在本申请实施例中，转发设备通过一个包含的目的IP地址为未使用的IP地址的ARP请求报文，发现内部网络中的一个主机进行探测的企图，该主机可能是被黑客或恶意软件控制的主机，从而在此时机确定后续蜜罐系统所需要模拟的对象，即诱捕目标。
为了让可能被控制的主机能够与诱捕目标进行后续通信，在步骤302确定ARP报文的目的IP地址的在线状态为不在线之后，步骤303将ARP报文的目的IP地址加入诱捕目标集合之前，还包括步骤305，转发设备返回ARP响应，ARP响应中携带伪造的MAC地址，伪造的MAC地址作为具有ARP请求报文的目的IP地址的主机的MAC地址。在使用表1所示的诱捕目标表存储诱捕目标集合的情况下，转发设备也可以在步骤303创建的表项中保存伪造的MAC地址。
可选地，如果转发设备每次接收到ARP请求报文时都需要执行附图3A所示的流程，将会增加转发设备的处理负担。为了节约转发设备的处理能力，在转发设备上设置白名单，白名单中包括已知的被合法用户使用的主机的IP地址、或MAC地址。当在上述步骤300之后、步骤301之前，转发设备接收到一个ARP报文后，首先查询白名单。如果该ARP报文的源IP地址、源MAC地址、目的IP地址或目的MAC地址属于白名单，则直接按照现有ARP报文转发流程转发该ARP报文即可。转发设备省略执行附图3A中的步骤301～303。
可选地，在步骤300转发设备接收到ARP报文之后，发送该ARP报文的主机使用的IP地址可以认为处于在线状态，转发设备根据ARP报文的源IP地址更新IP状态表，将该IP状态表中该ARP报文的源IP地址对应的在线状态更新为在线。
可选地，在步骤301中，如果转发设备确定该ARP报文的类型是ARP响应报文、或是免费ARP报文，说明发送该ARP响应报文、或免费ARP报文的主机是正常在线的主机，而不是蜜罐系统虚拟出的主机。如前所述，如果请求访问的目的方是未使用的IP地址(不在线的IP地址)，那么ARP响应报文是转发设备主动伪造的，而不会是转发设备接收到的。类似地，免费ARP报文发送方使用的IP地址可以认为是在线的IP地址。因此，如果转发设备确定该ARP报文的类型是ARP响应报文、或是免费ARP报文，执行步骤306。相当于增加了更新IP地址状态表的时机。
步骤306，转发设备判断诱捕目标集合中是否存在包含ARP报文的源IP地址。如果诱捕目标集合中存在包含ARP报文的源IP地址的表项，执行步骤307。
步骤307，从诱捕目标集合中删除作为未使用的IP地址的ARP报文的源IP地址。可选地，在使用表1所示的诱捕目标表存储诱捕目标集合的情况下，转发设备删除包含ARP报文的源IP地址的表项。
如果步骤306确定诱捕目标集合中不存在ARP报文的源IP地址，或者在步骤307中从诱捕目标集合中删除ARP报文的源IP地址之后，对ARP报文进行转发。
通过步骤306和步骤307，可以更新诱捕目标集合，避免将内部网络中进行正常业务的主机使用的IP地址作为诱捕目标，避免影响内部网络中正常业务。
可选地，采用步骤300～307获得诱捕目标集合之后，如果接收到一个IP报文，该IP报文的源地址为发送该IP报文的主机使用的IP地址。显然该IP报文的源地址是已被使用的IP地址，而不是未使用的IP地址。因此，如果诱捕目标集合中包含该IP报文的源地址，则应将该IP报文的源地址从诱捕目标集合中删除，以免发送该IP报文的主机后续无法与其他主机通信。
本实施例详细描述了转发设备确定所连接的子网中未使用的IP地址作为诱捕目标的过程。转发设备采用该方法构建诱捕目标集合后，后续转发设备根据诱捕目标集合实现引流。
附图4是本申请实施例提供的另一种创建诱捕目标集合的方法的流程图。附图4主要对上述第二种根据实际网络环境创建诱捕目标集合的方式进行描述，即转发设备在执行IP报文转发流程中，获取诱捕目标并将诱捕目标加入诱捕目标集合。
步骤400，转发设备接收一个IP报文。附图4所示的流程可以单独实施，也可以与附图2或附图3A所示的流程结合应用。为了在附图4所示的流程与附图2或附图3A所示的流程结合应用时与附图2所示流程中的第二IP报文相区分，将附图4中步骤400接收到的报文称为第三IP报文。需要指出的是第三IP报文不是附图2中的第二IP报文。第三IP报文可以是附图2中的第一IP报文，也可以是不同于第一IP报文和第二IP报文的另一IP报文。
步骤401，转发设备根据第三IP报文的目的IP地址，在转发设备的路由表中查询所述第三IP报文对应的下一跳IP地址。如果路由表中存在第三IP报文对应的下一跳IP地址，执行步骤420；如果路由表中不存在第三IP报文对应的下一跳IP地址，执行步骤430。
步骤420，转发设备在ARP表中查询下一跳IP地址对应的MAC地址。如果ARP表中不存在所述下一跳IP地址对应的MAC地址，则执行步骤421。如果ARP表中存在所述下一跳IP地址对应的MAC地址，则执行步骤423。
步骤421，转发设备根据IP地址状态表，确定第三IP报文的目的IP的在线状态。IP地址状态表的获取方式请参照前面实施例中的描述，在这里不再重复。
如果第三IP报文的目的IP的在线状态为在线，则执行步骤422。如果第三IP报文的目的IP的在线状态为不在线，则执行步骤430。
步骤422，转发设备发起ARP学习过程，根据后续学习到的目的MAC地址，对第三IP报文进行转发。即执行步骤423。
步骤423，转发设备按照已有IP报文转发流程，对该第三IP报文进行转发。
步骤430，转发设备将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。可选地，在使用表1所示的诱捕目标表存储诱捕目标集合的情况下，转发设备创建一个表项。所创建的表项中包含第三IP报文的目的IP地址。转发设备进一步将所创建的表项加入诱捕目标表。
可选地，转发设备采用附图4所示的流程获得诱捕目标表之后，还可以对第三IP报文进行诱捕，即执行步骤440～442。
步骤440，转发设备向所述蜜罐管理服务器发送所述第三IP报文。
步骤441，转发设备接收来自于蜜罐管理服务器的针对所述第三IP报文的响应报文。
步骤442，转发设备转发所述响应报文。
由于步骤440～442所述的诱捕过程与前面实施例描述类似，如附图2中的步骤204～206中的描述，在这里不再重复描述。
附图5是本申请实施例提供的另一种创建诱捕目标集合的具体方式的流程图。附图5主要对上述第三种根据实际网络环境创建诱捕目标集合的方式进行描述，即转发设备在处理第一预定类型报文(即通信请求方在建立IP会话阶段的RST报文或者ICMP不可达报文)的过程中，获取诱捕目标并将诱捕目标加入诱捕目标集合。附图5所示的流程可以单独实 施，也可以与附图2、3A或4所示的流程结合应用。为了在附图5所示的流程与附图2或附图3A所示的流程结合应用时与附图2所示流程中的第二IP报文相区分，将附图5中步骤501接收到的报文称为第四IP报文。需要指出的是第四IP报文不是附图2中的第二IP报文。第四IP报文可以是附图2中的第一IP报文，也可以是附图4中的第三IP报文，也可以是不同于第一IP报文、第二IP报文和第三IP报文的另一IP报文。
附图5所示的方法主要描述了确定子网访问内已使用的IP地址上未开放的端口作为诱捕目标的过程。附图5所示的流程描述了基于已知的包含子网中未使用的IP地址的诱捕目标集合，如何在诱捕目标集合中增加已使用的IP地址上未开放的端口的过程。在单独确定包含已使用的IP地址上未开放的端口的诱捕目标集合的过程包括附图4中的步骤503～513组成的子流程。附图5所示的方法在TCP会话建立阶段创建诱捕目标集合。
步骤501，转发设备接收到第四IP报文。以附图1中转发设备110为例的转发设备通过多个接口分别与子网中的若干主机连接、与蜜罐管理服务器120连接。可选地，转发设备还有可能通过其中的某些接口与其他转发设备，例如网关、或者其他交换机连接。
以转发设备110为例的转发设备中保存有转发表，转发表中保存有多个转发表项，每个转发表项包含一个交换机上的一个接口的接口标识，以及该接口连接的其他设备的MAC地址的对应关系。
步骤502，转发设备确定接收到的第四IP报文是否来自于蜜罐管理服务器。可选地，由于转发设备已知蜜罐管理服务器的IP地址和MAC地址，因此如果接收到第四IP报文的接口对应的MAC地址与蜜罐管理服务器的MAC地址相同，则转发设备可以确定第四IP报文来自于蜜罐管理服务器。反之，如果接收到第四IP报文的接口对应的MAC地址与蜜罐管理服务器的MAC地址不同，则转发设备可以确定第四IP报文不是来自于蜜罐管理服务器。
如果接收到的第四IP报文来自于蜜罐管理服务器，则该第四IP报文是通过转发设备和蜜罐管理服务器之间的隧道发送的，转发设备对第四IP报文进行解封装，获得上述第四IP报文的载荷中携带的报文，并对获得的报文进行转发，即执行步骤520。
如果接收到的IP报文不是来自于蜜罐管理服务器，则执行步骤503。
步骤503，转发设备判断所述第四IP报文是否为SYN报文、SYN_ACK报文、或RST报文。
TCP报文头中包括6个分别为1bit的标志位(flag)，分别是URG、ACK、PSH、RST、SYN和FIN。当TCP报文头中的这几个标志位分别被置1时，表示该标志位代表的含义当前是有效的。这里简单介绍这几个标志位分别代表的含义。其中，URG指示TCP报文头中的紧急指针(Urgent pointer)字段是有意义的。ACK指示确认(Acknowledgment)字段是有意义的，即表示该TCP报文是一个响应报文。PSH表示推动(push)功能，请求将缓存的数据推入接收应用，即表示有数据传输。RST表示重置连接。SYN表示同步序列号，即建立连接。FIN表示该TCP报文是来自于发送方的最后一个报文，即表示关闭连接。
6个标志位中仅标志位SYN置1的报文被称为SYN报文，标志位SYN和ACK同时被置1的报文被称为SYN_ACK报文、标志位RST被置1的报文被称为RST报文。
具体地，TCP协议连接建立过程中的报文包括SYN、SYN_ACK、和RST报文。其中SYN、SYN_ACK属于三次握手过程中的报文，所述三次握手用于建立通信双方之间的TCP连接。RST(复位)报文用于异常地关闭连接。主机上的TCP协议栈处理程序会在自身认为的异 常时刻发送RST包。例如，主机A向主机B发起连接，但主机B之上并未开放监听主机A请求建立连接的端口，这时主机B上的TCP协议栈处理程序发送RST报文。
如果所述第四IP报文不属于TCP协议连接建立过程中的报文，而是属于TCP连接建立之后发送的用于传输业务数据的IP报文，则转发设备执行步骤504。如果所述第四IP报文为SYN报文，则转发设备执行步骤507。如果所述第四IP报文为SYN_ACK报文，则转发设备执行步骤508。如果所述第四IP报文为RST报文，则转发设备执行步骤512。
IP协议除了包含上述TCP协议之外，还包含UDP协议。对于UDP协议处理过程而言，一个主机如果收到一个UDP数据报而该UDP数据报的目的端口号与本主机上正在使用的进程对应的端口号不相符，那么该主机返回一个ICMP不可达报文。因此ICMP不可达报文与RST报文具有类似的功能，即指示请求访问的端口号未开放。因此后续实施例将ICMP不可达报文与RST报文一并进行描述。
可选地，如果转发设备每次接收到ARP请求报文时都需要执行附图5所示的流程，将会增加转发设备的处理负担。为了节约转发设备的处理能力，在转发设备上设置白名单，白名单中包括已知的被合法用户使用的主机的IP地址、或MAC地址。当在上述步骤501之后、步骤503之前，转发设备接收到一个IP报文后，首先查询白名单，如果该IP报文的源IP地址、源MAC地址、目的IP地址或目的MAC地址属于白名单，则直接按照现有IP报文转发流程转发该IP报文即可。转发设备则无需识别该IP报文是SYN、SYN_ACK、或RST报文以及后续流程，即省略执行步骤503以及后续其他步骤。
步骤504，转发设备确定第四IP报文请求访问的目的方是否属于已有的诱捕目标，即第四IP报文是否应被诱捕。该步骤的具体实现细节请参考附图2步骤203中的描述，在这里不再重复。如果所述第四IP报文请求访问的目的方属于已有诱捕目标，则执行步骤505。如果所述第四IP报文请求访问的目的方不属于已有诱捕目标，则执行步骤506。
步骤505，转发设备通过转发设备与蜜罐管理服务器之间的隧道，将所述第四IP报文发送给蜜罐管理服务器。该步骤的具体实现细节请参考附图2步骤204中的描述，在这里不再重复。
步骤506，转发设备根据MAC表对所述第四IP报文进行转发、或者根据路由表结合ARP表对所述第四IP报文进行转发。具体地，如果转发设备的MAC表保存有该IP报文的目的MAC地址对应的接口号，转发设备根据MAC表查找到该IP报文的目的MAC地址对应的接口，并通过对应的接口将所述IP报文发送出去。如果转发设备的MAC表未保存有该IP报文的目的MAC地址对应的接口号，转发设备根据路由表和ARP表对所述IP报文进行转发。
可选地，当附图4所示的流程与附图5所示的流程结合使用时，转发设备对进入步骤506的第四IP报文执行如附图4所述的处理流程。换句话说，附图4中步骤400接收到的报文是附图1中转发设备110从任意一个接口接收到的IP报文，也可以是附图5中输入步骤506中的第四IP报文。
如前面实施例所提及的，诱捕目标还包括一个已使用的IP地址上未开放的端口。如果第四IP报文满足以下诱捕条件，则说明第四IP报文的目的方是一个已使用的IP地址上未开放的端口。诱捕条件为：在接收到第四IP报文之前，接收到至少一个与所述第四IP报文对应的SYN报文，所述第四IP报文对应的SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四 IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
在实际应用中，转发设备可以采用更为严格的诱捕条件以提高确定诱捕目标的准确性。例如诱捕条件为：在接收到第四IP报文之前的预定时间段之前接收到至少一个与所述第四IP报文对应的SYN报文、且在所述预定时间段内接收到的与所述第四IP报文具有相同源IP地址和源端口号的其他报文均为RST报文，所述第四IP报文对应的SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。
在指示请求访问的目的方不可达方面，对于UDP协议而言，ICMP不可达报文与上述RST报文具有类似的功能。如果第四IP报文为ICMP不可达报文。则对应的诱捕条件包括：在接收到第四IP报文之前，接收到至少一个与所述第四IP报文对应的UDP报文，所述第四IP报文对应的UDP报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
类似地，在第四IP报文为ICMP不可达报文的情况下，更为严格的诱捕条件包括：在接收到第四IP报文之前的预定时间段之前接收到至少一个与所述第四IP报文对应的UDP报文、且在所述预定时间段内接收到的与所述第四IP报文具有相同源IP地址和源端口号的其他报文均为ICMP不可达报文，所述第四IP报文对应的UDP报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
以第四IP报文为RST来举例，转发设备在时刻A接收到源IP地址为1.1.1.103、源端口号为80的RST报文。在时刻A的1分钟之前，转发设备接收到一个目的地址为1.1.1.103、目的端口号为80的SYN报文，且在时刻A之前的1分钟之内，接收到源IP地址为1.1.1.103、源端口号为80的报文均是RST报文，则确定IP地址1.1.1.103上的端口80为诱捕目标。
换句话说，转发设备在接收到目的地址为1.1.1.103，目的端口号为80的SYN报文之后的预定时间段内，接收到的源IP地址为1.1.1.103，源端口号为80的报文均为RST报文，则转发设备确定IP地址1.1.1.103上的端口80为诱捕目标。
基于上述思路，转发设备可以使用多种方式来识别出一个已使用的IP地址上未开放的端口。可选地，转发设备建立一个SYN请求表以识别潜在的诱捕目标，SYN请求表用于记录已接收到SYN报文，但尚未成功建立连接的请求目的方。
SYN请求表中包括一个或多个SYN表项。当转发设备接收到一个SYN报文时，查询SYN请求表中是否存在一个包含该SYN报文的目的IP地址与目的端口号的组合的SYN表项。如果已存在一个包含该SYN报文的目的IP地址与目的端口号的组合的SYN表项，则不对SYN请求表进行更新。如果不存在一个包含该SYN报文的目的IP地址与目的端口号的组合的SYN表项，则创建一个SYN表项，该SYN表项中包括SYN报文的目的IP地址与目的端 口号的组合。SYN表项中还包括接收到SYN报文的时间。
可选地，SYN请求表中的每个SYN表项还包括一个计数值，用于记录接收到的RST报文的数量。当转发设备接收到RST报文时，查询SYN请求表中是否存在一个包含该RST报文的源IP地址与源端口号的组合的SYN表项。如果存在已存在一个包含该RST报文的源IP地址与源端口号的组合的SYN表项，则将该SYN表项中的计数值累加1。
下面的步骤507～512以SYN记录表为例，介绍如何识别出已使用的IP地址上未开放的端口。显然，确定一个端口号是否符合以上诱捕条件的方式不仅限于步骤507～512所示的方法。
步骤507，转发设备根据第四IP报文的目的IP地址和目的端口号，查询SYN请求表，如果不存在对应的SYN表项，则创建一个SYN表项，并将该SYN表项加入SYN表。该SYN表项中包括SYN报文的目的IP地址与目的端口号的组合。
例如，建立的SYN请求表如表3所示。
表3
Figure PCTCN2020110656-appb-000002
在步骤507之后，转发设备执行步骤506，从而对SYN类型的第四IP报文进行转发。
如果所述第四IP报文是SYN_ACK报文，说明该第四IP报文来源于一个在线的IP地址，且来源于一个在线的IP地址上的一个开放的端口，因此该第四IP报文的源地址、以及源地址和源IP地址的组合均不属于诱捕目标。此时可以更新诱捕目标表、以及SYN请求表。
步骤508，在所述第四IP报文是SYN_ACK报文的情况下，转发设备判断诱捕目标表中是否存在包含所述第四IP报文的源IP地址、或源IP地址和源端口号的组合的表项。如果诱捕目标表中存在包含所述第四IP报文的源IP地址、或源IP地址和源端口号的组合的表项，则执行步骤509。如果诱捕目标表中不存在包含所述IP报文的源IP地址、或源IP地址和源端口号的组合的表项，则执行步骤510。
步骤509，转发设备从诱捕目标表中删除包含所述第四IP报文的源IP地址、或源IP地址和源端口号的组合的表项。
步骤510，转发设备判断SYN请求表中是否存在包含所述第四IP报文的源IP地址和源端口号的组合的表项。如果SYN请求表中存在包含所述第四IP报文的源IP地址和源端口号的组合的表项，则执行步骤511。如果诱捕目标表中不存在包含所述第四IP报文的源IP地址、或源IP地址和源端口号的组合的表项，则执行步骤506。
步骤511，转发设备从SYN表中删除包含所述第四IP报文的源IP地址和源端口号的组合的表项。
在SYN请求表中不存在包含所述第四IP报文的源IP地址和源端口号的组合的表项，或者从SYN表中删除包含所述第四IP报文的源IP地址和源端口号的组合的表项之后，执行步骤506。
如果所述第四IP报文是RST报文，说明该IP报文有可能来源于一个在线的IP地址 上的一个未开放的端口，此时应该结合SYN请求表，确认该RST报文的源端口号是否满足诱捕条件。在满足诱捕条件时，将RST报文的源端口加入诱捕目标，如果不满足诱捕条件，则更新SYN请求表中的记录。
步骤512，转发设备根据所述第四IP报文的源IP地址和源端口号，查询SYN请求表。如果SYN请求表中包含一个表项内容与所述IP报文的源IP地址和源端口号相同、且该表项中的时间距离接收到所述IP报文的时间超过设定阈值，则执行步骤513。如果SYN请求表中没有任何一个表项内容与所述IP报文的源IP地址和源端口号相同、或者该表项中的时间距离接收到所述IP报文的时间未超过设定阈值，则执行步骤506。
步骤513，转发设备将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集合。在以表1所示的诱捕目标表来表示诱捕目标集合的情况下，转发设备创建一个表项，新创建的表项中包含所述第四IP报文的源IP地址和所述第四IP报文的源端口号的组合，将新创建表项加入所述诱捕目标表。
步骤514，转发设备通过与蜜罐管理服务器之间的隧道向蜜罐管理服务器发送与类型为RST的第四IP报文对应的SYN报文。对应的SYN报文是目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同的SYN报文。
可选地，转发设备向蜜罐管理服务器发送的SYN报文是转发设备可以临时保存此前接收到的与类型为RST的第四IP报文对应的SYN报文。可替代地，转发设备向蜜罐管理服务器发送的SYN报文也可以是转发设备在判断第四IP报文满足上述诱捕条件的情况下，重新生成与类型为RST的第四IP报文对应的SYN报文。
由于ICMP不可达报文与RST报文在通知请求访问的端口不存在方面存在类似的功能，因此上述对RST报文执行的处理流程也适用于ICMP不可达报文。
附图6是本申请实施例提供的使用诱捕目标集合中的IP地址主动实施诱捕的方法流程图。附图6所示的方法主要描述了在DNS解析的过程中使用诱捕目标集合中的IP地址，对主机的网络访问行为实施诱捕的方案。可选地，附图6所示的方法中使用附图3A或附图5所示的方法获得诱捕目标集合中的IP地址实施诱捕。
可选地，附图6所示的流程在附图2中步骤201之后，步骤202之前执行。
步骤600，转发设备转发一个DNS域名请求。
步骤601，转发设备截获并停止转发第一DNS响应报文，该第一响应报文指示所述DNS域名请求所请求查询的域名不存在。
当一个主机想要访问一个IP地址未知的域名时，根据该主机内部配置的DNS服务器的IP地址，向网络中的DNS服务器发送DNS查询报文。该DNS查询报文中包含要访问的域名，例如http://www.baidu.com/。DNS服务器向主机返回对应的DNS响应报文。如果DNS服务器在DNS数据中查询到所请求的域名http://www.baidu.com/对应的IP地址，则在DNS响应报文中携带查询到的IP地址。如果DNS数据库中不存在请求的域名，则在DNS响应报文中指示域名不存在，例如通过将DNS响应报文消息头中的RCODE字段的值置为3，指示所请求查询的域名不存在。
可选地，转发设备截获第一DNS响应报文后，丢弃第一DNS响应报文。
步骤602，转发设备生成第二DNS响应报文，所述第二DNS响应报文包括所述DNS域名请求所查询的域名对应的IP地址，所述域名对应的IP地址为所述诱捕目标集合中的一 个未使用的IP地址。
可选地，转发设备在接收到第一DNS响应报文之前缓存DNS域名请求，在接收到第一DNS响应报文之后，根据DNS域名请求生成第二DNS响应报文。为了节省存储空间，转发设备也可以不缓存DNS域名请求，而是在接收到第一DNS响应报文之后，根据第一DNS响应报文生成第二DNS响应报文，所述第二DNS响应报文的地址信息与所述第一DNS响应报文的地址信息相同、且所述第二DNS响应报文指示所查询的域名对应的IP地址为诱捕目标集合中的一个IP地址。地址信息是指源IP地址、源端口号、目的IP地址和目的端口号。转发设备通过将第一DNS响应报文中的一些字段内容重新设置，从而生成第二DNS响应报文。转发设备将RCODE字段的值置为1,指示查询没有错误，并在第一DNS响应报文中的Answer资源记录的RDATA字段的内容设置为诱捕目标集合中的一个IP地址，从而得到第二DNS响应报文。
步骤603，转发设备发送所述第二DNS响应报文。
此后，接收到第二DNS响应报文的主机后续以第二DNS响应报文中携带的诱捕目标集合中的IP地址作为请求访问的目的方发起访问。转发设备将所述主机后续访问诱捕目标的报文通过隧道向蜜罐管理服务器发送，从而实现对主机网络访问行为的诱捕。
在本申请实施例中转发设备在DNS解析的过程中使用诱捕目标集合中的IP地址，对主机的网络访问行为实施诱捕，从而实现主动地对潜在的攻击者的DNS探测行为进行诱捕，有助于网络威胁诱捕系统达到更佳的诱捕效果。
附图7是本申请实施例提供的一种转发设备的结构示意图。图7所示的转发设备作为图2、图3A、图3B、图4、图5或图6所示流程中的网络设备，以实现图1中的转发设备的功能。转发设备包括至少一个处理器71、和网络接口73。可选地，转发设备还包括存储器72。处理器71、存储器72和网络接73通常通过总线74相互连接，也可以采用其他方式相互连接，例如通过交换网卡相互连接。
至少一个处理器71可以是一个或多个CPU，该CPU可以是单核CPU，也可以是多核CPU。
存储器72包括但不限于是随机存取存储器(random access memory，RAM)、只读存储器(Read only Memory，ROM)、可擦除可编程只读存储器(erasable programmable read-only memory，EPROM或者快闪存储器)、、三态内容可寻址存储器(ternary content addressable memory，TCAM)、快闪存储器、或光存储器等。存储器72中保存有操作系统的代码。
网络接口73可以是有线接口，例如光纤分布式数据接口(Fiber Distributed Data Interface，FDDI)、千兆以太网(Gigabit Ethernet，GE)接口；网络接口73也可以是无线接口。网络接口73用于接收报文或者发送报文。包括包括但不限于上述实施例提及的ARP报文、IP报文或者ICMP报文等等。
可选地，处理器71通过读取存储器72中保存的程序代码实现上述实施例中的方法，或者，处理器71也可以通过内部存储的指令实现上述实施例中的方法。在处理器71通过读取存储器72中保存的程序代码实现上述实施例中的方法的情况下，存储器72中保存实现本申请上述实施例提供的方法的程序代码。
处理器71用于读取存储器32中存储的程序代码，执行以下操作：获得诱捕目标集合，所述诱捕目标集合中包括至少一个诱捕目标，所述至少一个诱捕目标包括未使用的IP地址、或者已使用的IP地址上未开放的端口号。
所述网络接口73，接收来自于第一主机的第一IP报文。
所述处理器71，还用于确定所述第一IP报文请求访问的目的方是否属于所述诱捕目标集合。
所述网络接口73，还用于如果所述第一IP报文请求访问的目的方属于所述诱捕目标集合，向蜜罐管理服务器发送所述第一IP报文；接收所述蜜罐管理服务器返回的第二IP报文，所述第二IP报文是所述第一IP报文的响应报文；以及向所述第一主机发送所述第二IP报文。
网络接口73或者处理器71实现上述功能的更多细节请参考前面各个方法实施例中的描述，在这里不再重复。
可选地，转发设备还包括输入输出接口75，输入输出接口75用于与输入设备连接，接收用户通过输入设备输入的配置信息。输入设备包括但不限于键盘、触摸屏、麦克风等等。输入输出接口75还用于与输出设备连接，输出处理器71确定出的诱捕目标集合。输出设备包括但不限于显示器、打印机等等。
图8是本申请实施例提供的一种网络威胁的诱捕装置的结构示意图。该网络威胁诱捕装置80包括处理模块81、接收模块82和发送模块83。
处理模块81，用于获得诱捕目标集合，所述诱捕目标集合中包括至少一个诱捕目标，所述至少一个诱捕目标包括未使用的IP地址、或者已使用的IP地址上未开放的端口号；
接收模块82，用于接收来自于第一主机的第一IP报文；
所述处理模块81，还用于确定所述第一IP报文请求访问的目的方是否属于所述诱捕目标集合；
发送模块83，用于如果所述第一IP报文请求访问的目的方属于所述诱捕目标集合，向蜜罐管理服务器发送所述第一IP报文；
所述接收模块82，还用于接收所述蜜罐管理服务器返回的第二IP报文，所述第二IP报文是所述第一IP报文的响应报文；
所述发送模块83，还用于向所述第一主机发送所述第二IP报文。
可选地，接收模块82，还用于接收第一ARP报文，所述第一ARP报文是ARP请求报文。
处理模块81，还用于根据IP地址状态表，确定所述第一ARP报文的目的IP地址的在线状态，所述IP地址状态表用于指示所述网络威胁诱捕装置连接的子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线；如果所述第一ARP报文的目的IP地址的在线状态为不在线，则将所述第一ARP请求报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，接收模块82，还用于接收第二ARP报文，所述第二ARP报文是ARP应答报文或者免费ARP报文。处理模块81，还用于判断所述诱捕目标集合中是否包含所述第二ARP报文的源IP地址.如果所述诱捕目标集合中包含所述第二ARP报文的源IP地址，则从所述诱捕目标集合中删除作为未使用的IP地址的所述第二ARP报文的源IP地址。
可选地，接收模块82，还用于接收第三IP报文。处理模块81，还用于根据所述第三IP报文的目的IP地址，在所述网络威胁诱捕装置的路由表中查询所述第三IP报文对应的下一跳IP地址；如果所述路由表中不存在所述第三IP报文对应的下一跳IP地址，则将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，处理模块81，还用于如果所述路由表中存在所述第三IP报文对应的下一跳 IP地址，则在ARP表中查询所述下一跳IP地址对应的MAC地址；如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址，则所述根据IP地址状态表，确定所述第三IP报文的目的IP的在线状态，所述IP地址状态表用于指示所述网络威胁诱捕装置连接的至少一个子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线；如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第三IP报文的目的IP地址的在线状态为不在线，则将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
可选地，接收模块82，还用于接收第四IP报文，所述第四IP报文为RST报文。处理模块81，还用于判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：在接收到第四IP报文之前，接收到至少一个与所述第四IP报文对应的SYN报文，所述第四IP报文对应的SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同；如果所述第四IP报文满足诱捕条件，则将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
可选地，接收模块82，还用于接收第四IP报文，所述第四IP报文为ICMP不可达报文。处理模块81，还用于判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：在接收到第四IP报文之前，接收到至少一个与所述第四IP报文对应的UDP报文，所述第四IP报文对应的UDP报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同。如果所述第四IP报文满足诱捕条件，则将所述第四IP报文的源IP地址作为已使用的IP地址，将所述第四IP报文的源端口号作为所述第四IP报文的源IP地址指示的IP地址上未开放的端口号加入诱捕目标集。
可选地，接收模块82，还用于接收第四IP报文，所述第四IP报文为SYN-ACK报文。处理模块81，还用于判断所述诱捕目标集合中是否包括待删除诱捕目标，所述待删除诱捕目标为已使用的IP地址上未开放的端口号，其中，已使用的IP地址为所述第四IP报文的源IP地址、所述未开放的端口号为所述第四IP报文的源端口号指示的端口号；如果所述诱捕目标集合中包括待删除诱捕目标，则从所述诱捕目标集合中删除所述待删除诱捕目标。
可选地，接收模块82和所述发送模块83，还用于转发DNS域名请求。接收模块82，还用于截获并停止转发第一DNS响应报文，所述第一DNS响应报文是针对所述DNS域名请求的响应报文，所述第一DNS响应报文指示所述DNS域名请求所查询的域名不存在。处理模块81，还用于生成第二DNS响应报文，所述第二DNS响应报文包括所述DNS域名请求所查询的域名对应的IP地址，所述域名对应的IP地址为所述诱捕目标集合中的一个未使用的IP地址。发送模块83，还用于发送所述第二DNS响应报文。
附图8所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。附图8中上述各个模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如，采用软件实现时，上述接收模块82、处理模块81和发送模块83可以是由附图7中的CPU读取存储器中存储的程序代码后，生成的软件功能模 块来实现。图8中上述各个模块也可以由转发设备中的不同硬件分别实现，例如接收模块82和发送模块83由附图7中的网络接口73实现，处理模块81由附图7中的处理器71实现，或者采用现场可编程门阵列(Field－Programmable Gate Array，FPGA)、或协处理器等可编程器件来完成。显然上述功能模块也可以采用软件硬件相结合的方式来实现，例如接收模块82和发送模块83由硬件可编程器件实现，而处理模块81是由CPU读取存储器中存储的程序代码后，生成的软件功能模块。
附图8中处理模块81，接收模块82和发送模块83实现上述功能的更多细节请参考前面各个方法实施例中的描述，在这里不再重复。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若对本申请的这些修改和变型属于本申请权利要求的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (26)

  1. 一种网络威胁的诱捕方法，其特征在于，包括：
    转发设备获得诱捕目标集合，所述诱捕目标集合中包括至少一个诱捕目标，所述至少一个诱捕目标包括未使用的网际协议IP地址、或者已使用的IP地址上未开放的端口号；
    所述转发设备接收来自于第一主机的第一IP报文；
    所述转发设备确定所述第一IP报文请求访问的目的方是否属于所述诱捕目标集合；
    如果所述第一IP报文请求访问的目的方属于所述诱捕目标集合，所述转发设备向蜜罐管理服务器发送所述第一IP报文；
    所述转发设备接收所述蜜罐管理服务器返回的第二IP报文，所述第二IP报文是所述第一IP报文的响应报文；
    所述转发设备向所述第一主机发送所述第二IP报文。
  2. 根据权利要求1所述的方法，其特征在于，所述获得诱捕目标集合包括：
    所述转发设备接收第一地址解析协议ARP报文，所述第一ARP报文是ARP请求报文；
    所述转发设备根据IP地址状态表，确定所述第一ARP报文的目的IP地址的在线状态，所述IP地址状态表用于指示所述转发设备连接的子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线；
    如果所述第一ARP报文的目的IP地址的在线状态为不在线，则所述转发设备将所述第一ARP请求报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
  3. 根据权利要求2所述的方法，其特征在于，还包括：
    所述转发设备接收第二ARP报文，所述第二ARP报文是ARP应答报文或者免费ARP报文；
    所述转发设备判断所述诱捕目标集合中是否包含所述第二ARP报文的源IP地址；
    如果所述诱捕目标集合中包含所述第二ARP报文的源IP地址，则所述转发设备从所述诱捕目标集合中删除作为未使用的IP地址的所述第二ARP报文的源IP地址。
  4. 根据权利要求1所述的方法，其特征在于，所述获得诱捕目标集合，包括：
    接收第三IP报文；
    所述转发设备根据所述第三IP报文的目的IP地址，在所述转发设备的路由表中查询所述第三IP报文对应的下一跳IP地址；
    如果所述路由表中不存在所述第三IP报文对应的下一跳IP地址，则所述转发设备将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
  5. 根据权利要求4所述的方法，其特征在于，如果所述路由表中不存在所述第三IP报文对应的下一跳IP地址，所述方法还包括：
    所述转发设备向所述蜜罐管理服务器发送所述第三IP报文；
    所述转发设备接收来自于所述蜜罐管理服务器的针对所述第三IP报文的响应报文，并转发所述响应报文。
  6. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    如果所述路由表中存在所述第三IP报文对应的下一跳IP地址，则所述转发设备在ARP表中查询所述下一跳IP地址对应的媒体访问控制MAC地址；
    如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址，则所述转发设备根据 IP地址状态表，确定所述第三IP报文的目的IP的在线状态，所述IP地址状态表用于指示所述转发设备连接的至少一个子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线；
    如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第三IP报文的目的IP地址的在线状态为不在线，则所述转发设备将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
  7. 根据权利要求6所述的方法，其特征在于，如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第三IP报文的目的IP地址的在线状态为不在线，所述方法还包括：
    向所述蜜罐管理服务器发送所述第三IP报文；
    接收来自于所述蜜罐管理服务器的针对所述第三IP报文的响应报文，并转发所述响应报文。
  8. 根据权利要求1所述的方法，其特征在于，所述获得诱捕目标集合，包括：
    所述转发设备接收第四IP报文，所述第四IP报文为连接重置RST报文；
    判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：
    在接收到所述第四IP报文之前，接收到至少一个与所述第四IP报文对应的连接建立SYN报文，所述SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同；
    如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源端口号作为已使用的IP地址上未开放的端口号加入诱捕目标集，其中所述已使用的IP地址为所述第四IP报文的源IP地址。
  9. 根据权利要求1所述的方法，其特征在于，所述获得诱捕目标集合，包括：
    所述转发设备接收第四IP报文，所述第四IP报文为RST报文；
    判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：
    在接收到第四IP报文之前的预定时间段之前接收到至少一个与所述第四IP报文对应的SYN报文、且在所述预定时间段内接收到的与所述第四IP报文具有相同源IP地址和源端口号的其他报文均为RST报文或者Internet控制报文协议ICMP不可达报文，所述第四IP报文对应的SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同；
    如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源端口号作为已使用的IP地址上未开放的端口号加入诱捕目标集，其中所述已使用的IP地址为所述第四IP报文的源IP地址。
  10. 根据权利要求9所述的方法，其特征在于，如果所述第四IP报文满足诱捕条件，还包括：
    向所述蜜罐管理服务器发送与所述第四IP报文对应的SYN报文；
    接收来自于所述蜜罐管理服务器的针对所述SYN报文的响应报文，并向所述第一主机转发所述针对所述SYN报文的响应报文。
  11. 根据权利要求1所述的方法，其特征在于，所述获得诱捕目标集合，包括：
    所述转发设备接收第四IP报文，所述第四IP报文为ICMP不可达报文；
    判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：
    在接收到所述第四IP报文之前，接收到至少一个与所述第四IP报文对应的用户数据报协议UDP报文，所述UDP报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同；
    如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源端口号作为已使用的IP地址上未开放的端口号加入诱捕目标集，其中所述已使用的IP地址为所述第四IP报文的源IP地址。
  12. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述转发设备接收第四IP报文，所述第四IP报文为连接建立确认SYN-ACK报文；
    所述转发设备判断所述诱捕目标集合中是否包括待删除诱捕目标，所述待删除诱捕目标为已使用的IP地址上未开放的端口号，其中，已使用的IP地址为所述第四IP报文的源IP地址、所述未开放的端口号为所述第四IP报文的源端口号；
    如果所述诱捕目标集合中包括待删除诱捕目标，则所述转发设备从所述诱捕目标集合中删除所述待删除诱捕目标。
  13. 根据权利要求2、6或7所述的方法，其特征在于，所述IP地址状态表是采用以下步骤获得的：
    所述转发设备针对所述转发设备连接的子网范围内的多个IP地址中的每个IP地址分别发送ARP请求报文；
    所述转发设备未接收到针对第一IP地址的ARP响应报文，将所述第一IP地址添加到所述IP地址状态表中，所述第一IP地址为所述多个IP地址中的IP地址；并将所述第一IP地址的状态设置为不在线。
  14. 根据权利要求13所述的方法，其特征在于，所述转发设备接收到针对第二IP地址的ARP响应报文，所述第二IP地址为所述多个IP地址中的IP地址；将所述第二IP地址添加到所述IP地址状态表中；并将所述第二IP地址的状态设置为在线。
  15. 根据权利要求1至14任一所述的方法，其特征在于，所述获得诱捕目标集合之后，所述方法还包括：
    所述转发设备转发域名系统DNS域名请求；
    所述转发设备截获并停止转发第一DNS响应报文，所述第一DNS响应报文是针对所述DNS域名请求的响应报文，所述第一DNS响应报文指示所述DNS域名请求所查询的域名不存在；
    所述转发设备生成第二DNS响应报文，所述第二DNS响应报文包括所述DNS域名请求所查询的域名对应的IP地址，所述域名对应的IP地址为所述诱捕目标集合中的一个未使用的IP地址；
    所述转发设备发送所述第二DNS响应报文。
  16. 根据权利要求1至15任一所述的方法，其特征在于，所述诱捕目标集合表示为诱捕目标表，所述诱捕目标表中包括至少一个表项，所述至少一个表项中的每个表项用于指示一个所述诱捕目标，所述每个表项包括一个IP地址用以指示未使用的IP地址、或者包括一个IP地址与端口号的组合用以指示已使用的IP地址上未开放的端口号；
    所述转发设备确定所述第一IP报文请求访问的目的方是否属于诱捕目标集合，包括：
    所述转发设备确定所述诱捕目标表中是否存在一个表项包括所述第一IP报文的目的IP地址、或者包括所述第一IP报文的目的IP地址与目的端口号的组合；
    如果所述诱捕目标表存在一个表项包括所述第一IP报文的目的IP地址、或者包括所述第一IP报文的目的IP地址与目的端口号的组合，则确定所述第一IP报文请求访问的目的方属于所述诱捕目标集合；
    如果所述诱捕目标表不存在一个表项包括所述第一IP报文的目的IP地址、并且不存在一个表项包括所述第一IP报文的目的IP地址与目的端口号的组合，则确定所述第一IP报文请求访问的目的方不属于所述诱捕目标集合。
  17. 一种转发设备，其特征在于，包括网络接口和至少一个处理器，
    所述至少一个处理器用于执行以下操作：
    获得诱捕目标集合，所述诱捕目标集合中包括至少一个诱捕目标，所述至少一个诱捕目标包括未使用的网际协议IP地址、或者已使用的IP地址上未开放的端口号；
    所述网络接口，用于接收来自于第一主机的第一IP报文；
    所述处理器还用于确定所述第一IP报文请求访问的目的方是否属于所述诱捕目标集合；
    所述网络接口还用于如果所述第一IP报文请求访问的目的方属于所述诱捕目标集合，向蜜罐管理服务器发送所述第一IP报文；接收所述蜜罐管理服务器返回的第二IP报文，所述第二IP报文是所述第一IP报文的响应报文；向所述第一主机发送所述第二IP报文。
  18. 根据权利要求17所述的转发设备，其特征在于，
    所述网络接口还用于接收第一地址解析协议ARP报文，所述第一ARP报文是ARP请求报文；
    所述至少一个处理器还用于根据IP地址状态表，确定所述第一ARP报文的目的IP地址的在线状态，所述IP地址状态表用于指示所述转发设备连接的子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线；如果所述第一ARP报文的目的IP地址的在线状态为不在线，则将所述第一ARP请求报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
  19. 根据权利要求18所述的转发设备，其特征在于，
    所述网络接口还用于接收第二ARP报文，所述第二ARP报文是ARP应答报文或者免费ARP报文；
    所述至少一个处理器还用于判断所述诱捕目标集合中是否包含所述第二ARP报文的源IP地址；如果所述诱捕目标集合中包含所述第二ARP报文的源IP地址，则从所述诱捕目标集合中删除作为未使用的IP地址的所述第二ARP报文的源IP地址。
  20. 根据权利要求17所述的转发设备，其特征在于，
    所述网络接口还用于接收第三IP报文；
    所述至少一个处理器还用于根据所述第三IP报文的目的IP地址，在路由表中查询所述第三IP报文对应的下一跳IP地址；如果所述路由表中不存在所述第三IP报文对应的下一跳IP地址，则将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
  21. 根据权利要求20所述的转发设备，其特征在于，
    所述至少一个处理器还用于如果所述路由表中存在所述第三IP报文对应的下一跳IP地址，则所述转发设备在ARP表中查询所述下一跳IP地址对应的媒体访问控制MAC地址；
    如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址，则根据IP地址状态表， 确定所述第三IP报文的目的IP的在线状态，所述IP地址状态表用于指示所述转发设备连接的至少一个子网范围内的多个IP地址分别对应的在线状态，所述在线状态为在线或不在线；
    如果所述ARP表中不存在所述下一跳IP地址对应的MAC地址、且所述第三IP报文的目的IP地址的在线状态为不在线，则将所述第三IP报文的目的IP地址作为未使用的IP地址加入所述诱捕目标集合。
  22. 根据权利要求17所述的转发设备，其特征在于，
    所述网络接口还用于接收第四IP报文，所述第四IP报文为连接重置RST报文；
    所述至少一个处理器还用于判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：
    在接收到所述第四IP报文之前，接收到至少一个与所述第四IP报文对应的连接建立SYN报文，所述第四IP报文对应的SYN报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同；如果所述第四IP报文满足诱捕条件，则所述转发设备将所述第四IP报文的源端口号作为已使用的IP地址上未开放的端口号加入诱捕目标集，其中所述已使用的IP地址为第四IP报文的源IP地址。
  23. 根据权利要求17所述的转发设备，其特征在于，
    所述网络接口还用于接收第四IP报文，所述第四IP报文为Internet控制报文协议ICMP不可达报文；
    所述至少一个处理器还用于判断所述第四IP报文是否满足诱捕条件，所述诱捕条件包括：
    在接收到第四IP报文之前，接收到至少一个与所述第四IP报文对应的用户数据报协议UDP报文，所述第四IP报文对应的UDP报文的目的IP地址与所述第四IP报文的源IP地址相同、且目的端口号与所述第四IP报文的源端口号相同；如果所述第四IP报文满足诱捕条件，则将将所述第四IP报文的源端口号作为已使用的IP地址上未开放的端口号加入诱捕目标集，其中所述已使用的IP地址为所述第四IP报文的源IP地址。
  24. 根据权利要求17至23任一所述的转发设备，其特征在于，
    所述网络接口还用于转发DNS域名请求；截获并停止转发第一DNS响应报文，所述第一DNS响应报文是针对所述DNS域名请求的响应报文，所述第一DNS响应报文指示所述DNS域名请求所查询的域名不存在；
    所述至少一个处理器还用于生成第二DNS响应报文，所述第二DNS响应报文包括所述DNS域名请求所查询的域名对应的IP地址，所述域名对应的IP地址为所述诱捕目标集合中的一个未使用的IP地址；
    所述网络接口还用于发送所述第二DNS响应报文。
  25. 一种网络威胁诱捕系统，其特征在于，包括蜜罐管理服务器以及至少一个如权利要求17至24任一所述的转发设备。
  26. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求1-16任一项所述的方法。
PCT/CN2020/110656 2019-08-22 2020-08-22 网络威胁的诱捕方法、系统和转发设备 WO2021032207A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20855435.2A EP3923551A4 (en) 2019-08-22 2020-08-22 METHOD AND SYSTEM FOR INTERCEPTING A NETWORK THREAT AND FORWARDING DEVICE
US17/369,057 US20210344714A1 (en) 2019-08-22 2021-07-07 Cyber threat deception method and system, and forwarding device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910780575.2 2019-08-22
CN201910780575.2A CN112422481B (zh) 2019-08-22 2019-08-22 网络威胁的诱捕方法、系统和转发设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/369,057 Continuation US20210344714A1 (en) 2019-08-22 2021-07-07 Cyber threat deception method and system, and forwarding device

Publications (1)

Publication Number Publication Date
WO2021032207A1 true WO2021032207A1 (zh) 2021-02-25

Family

ID=74660543

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/110656 WO2021032207A1 (zh) 2019-08-22 2020-08-22 网络威胁的诱捕方法、系统和转发设备

Country Status (4)

Country Link
US (1) US20210344714A1 (zh)
EP (1) EP3923551A4 (zh)
CN (1) CN112422481B (zh)
WO (1) WO2021032207A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114584349A (zh) * 2022-02-15 2022-06-03 烽台科技（北京）有限公司 网络数据的保护方法、装置、终端及可读存储介质

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113163276A (zh) * 2020-01-22 2021-07-23 华为技术有限公司 路由信息的发布方法、装置及系统
TWI821633B (zh) * 2021-01-22 2023-11-11 飛泓科技股份有限公司 網路終端設備隔離認證方法
US11863526B2 (en) * 2021-02-12 2024-01-02 Paypal, Inc. Dynamically routing network traffic between defense layers
CN113302887B (zh) * 2021-03-31 2023-08-01 华为技术有限公司 一种基于时间敏感传输协议的通信方法和相关装置
CN113098868B (zh) * 2021-04-01 2022-03-11 广州巨时信息科技股份有限公司 一种基于容器的网络安全处理方法和装置
CN113098895A (zh) * 2021-04-26 2021-07-09 成都中恒星电科技有限公司 一种基于dpdk的网络流量隔离系统
CN113285926B (zh) * 2021-04-26 2022-11-11 南方电网数字电网研究院有限公司 面向电力监控系统的蜜罐诱捕方法、装置、计算机设备
CN113572793B (zh) * 2021-09-26 2021-12-21 苏州浪潮智能科技有限公司 访问请求捕获方法、装置、计算机设备和存储介质
CN113992370B (zh) * 2021-10-19 2022-06-17 广州锦行网络科技有限公司 一种流量转发控制方法及基于流量转发控制的诱捕节点
CN113709186B (zh) * 2021-10-22 2022-03-01 杭州海康威视数字技术股份有限公司 一种高效蜜罐代理转发的方法与装置
US20230208803A1 (en) * 2021-12-29 2023-06-29 Mastercard International Incorporated Ip address control system
CN114491533A (zh) * 2022-01-24 2022-05-13 烽台科技（北京）有限公司 数据处理方法、装置、服务器及存储介质
CN115174467B (zh) * 2022-06-28 2023-09-22 福州大学 基于可编程数据平面的路由跳变防御构建方法
CN115378906B (zh) * 2022-08-16 2024-02-13 北京轻网科技股份有限公司 一种基于vpn框架的本地dns代理方法、装置、设备及介质
CN116915518B (zh) * 2023-09-14 2023-12-01 国网浙江省电力有限公司电力科学研究院 一种智能学习式自应答联网蜜罐诱导方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103139184A (zh) * 2011-12-02 2013-06-05 中国电信股份有限公司 智能网络防火墙设备及网络攻击防护方法
CN107809425A (zh) * 2017-10-20 2018-03-16 杭州默安科技有限公司 一种蜜罐部署系统
CN109302426A (zh) * 2018-11-30 2019-02-01 东软集团股份有限公司 未知漏洞攻击检测方法、装置、设备及存储介质
CN109768993A (zh) * 2019-03-05 2019-05-17 中国人民解放军32082部队 一种高覆盖内网蜜罐系统
US20190238589A1 (en) * 2016-01-29 2019-08-01 Sophos Limited Honeypot network services

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100344135C (zh) * 2003-03-20 2007-10-17 华为技术有限公司 一种ip地址的核查方法
US8127356B2 (en) * 2003-08-27 2012-02-28 International Business Machines Corporation System, method and program product for detecting unknown computer attacks
US8949986B2 (en) * 2006-12-29 2015-02-03 Intel Corporation Network security elements using endpoint resources
CN101552724B (zh) * 2009-05-11 2012-09-05 杭州华三通信技术有限公司 一种邻居表项的生成方法和装置
US9979738B2 (en) * 2012-01-23 2018-05-22 Hrl Laboratories, Llc System and method to detect attacks on mobile wireless networks based on motif analysis
CN104021344B (zh) * 2014-05-14 2015-06-24 南京大学 一种用于收集和截获计算机内存行为的蜜罐方法
WO2015174100A1 (ja) * 2014-05-14 2015-11-19 学校法人東京電機大学 パケット転送装置、パケット転送システム及びパケット転送方法
CN104113553A (zh) * 2014-07-29 2014-10-22 网神信息技术（北京）股份有限公司 端口状态识别方法、装置和系统
US11277390B2 (en) * 2015-01-26 2022-03-15 Listat Ltd. Decentralized cybersecure privacy network for cloud communication, computing and global e-commerce
US10536357B2 (en) * 2015-06-05 2020-01-14 Cisco Technology, Inc. Late data detection in data center
WO2017209845A1 (en) * 2016-06-01 2017-12-07 Acalvio Technologies, Inc. Deception to detect network scans
CN109413709B (zh) * 2018-11-21 2022-03-29 上海事凡物联网科技有限公司 自组网静态路由方法、装置、通信节点及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103139184A (zh) * 2011-12-02 2013-06-05 中国电信股份有限公司 智能网络防火墙设备及网络攻击防护方法
US20190238589A1 (en) * 2016-01-29 2019-08-01 Sophos Limited Honeypot network services
CN107809425A (zh) * 2017-10-20 2018-03-16 杭州默安科技有限公司 一种蜜罐部署系统
CN109302426A (zh) * 2018-11-30 2019-02-01 东软集团股份有限公司 未知漏洞攻击检测方法、装置、设备及存储介质
CN109768993A (zh) * 2019-03-05 2019-05-17 中国人民解放军32082部队 一种高覆盖内网蜜罐系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3923551A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114584349A (zh) * 2022-02-15 2022-06-03 烽台科技（北京）有限公司 网络数据的保护方法、装置、终端及可读存储介质

Also Published As

Publication number Publication date
EP3923551A1 (en) 2021-12-15
US20210344714A1 (en) 2021-11-04
EP3923551A4 (en) 2022-04-20
CN112422481B (zh) 2021-10-26
CN112422481A (zh) 2021-02-26

Similar Documents

Publication Publication Date Title
WO2021032207A1 (zh) 网络威胁的诱捕方法、系统和转发设备
US10033696B1 (en) Identifying applications for intrusion detection systems
US9276907B1 (en) Load balancing in a network with session information
US9258329B2 (en) Dynamic access control policy with port restrictions for a network security appliance
EP3507964B1 (en) Malware detection for proxy server networks
US10375110B2 (en) Luring attackers towards deception servers
US10116696B2 (en) Network privilege manager for a dynamically programmable computer network
WO2019179375A1 (zh) 一种防御网络攻击的方法及装置
US11570207B2 (en) Dynamic security actions for network tunnels against spoofing
US11968174B2 (en) Systems and methods for blocking spoofed traffic
US20180191525A1 (en) Network device using ip address and method thereof
CN112134891A (zh) 一种基于linux系统的单主机产生多个蜜罐节点的配置方法、系统、监测方法
US11489815B2 (en) Methods and systems for synchronizing state amongst monitoring nodes
Mohammadnia et al. IoT-NETZ: Practical spoofing attack mitigation approach in SDWN network
Shiranzaei et al. IPv6 security issues—A systematic review
US8893271B1 (en) End node discovery and tracking in layer-2 of an internet protocol version 6 network
Dulik Network attack using TCP protocol for performing DoS and DDoS attacks
Sharma et al. Self-healing topology for DDoS attack identification & discovery protocol in software-defined networks
Abdulla Survey of security issues in IPv4 to IPv6 tunnel transition mechanisms
Wang et al. EC-NTD: Efficient countermeasure against DrDoS attacks with NAPT and two-stage detection in SDN-based networks
Wang et al. Achieving a scalable and secure software defined network by identifiers separating and mapping
Rietz et al. Research Article An SDN-Based Approach to Ward Off LAN Attacks
Chen et al. Universal honeyfarm containment
Tang et al. Blocking DoS attack traffic in network with locator/identifier separation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20855435

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020855435

Country of ref document: EP

Effective date: 20210908

NENP Non-entry into the national phase

Ref country code: DE