CN104917757A - Event-triggered MTD protection system and method - Google Patents

Abstract

The invention relates to an event-triggered MTD protection system and method. According to the invention, through the analysis of an operation system initiative fingerprint identification method and a detection packet, a detection event set is formulated, and event-triggered MTD hidden operation system characteristic protection ideas are designed. Each time a protected target receives the detection data packet of a fingerprinter, a characteristic corresponding to a detection item automatically changes. The fingerprint characteristic collected by the fingerprinter is wrong information, so that being deceived or confused into another device type is realized. Some important basic equipment is provided with an effective remote fingerprint identification resistance protection mechanism.

Description

An event-triggered MTD protection system and method

technical field

The invention relates to the field of hidden protection of national important infrastructure equipment, in particular to an event-triggered MTD protection system and method.

Background technique

In the current environment, information technology systems are built to operate in relatively static configurations. For example, addresses, names, software stacks, networking, and various configuration parameters remain relatively static over extended periods of time. This static method allows attackers who intend to exploit malicious vulnerabilities on the system to have sufficient time to search, detect and identify information such as the version and configuration of the target system, the most representative of which is the operating system fingerprint detection and Identification (Operating System Fingerprinting Detection), that is, to determine the operating system used by collecting the feature difference information of the active (active) or passive (passive) detection packets on the host on the network, usually used by attackers as The most important step in information gathering before an attack.

The idea of MTD (Moving Target Defense) is a new concept based on controlling changes across multiple system dimensions, increasing the uncertainty and complexity of the system, thereby reducing the attacker's attack surface and increasing the attack cost. Since MTD was proposed in 2011, it has gradually developed into a research hotspot in the field of system protection, and has been identified by the White House as one of the four major cyberspace security protection strategic technologies for future development.

As an important security protection system, in recent years, the MTD idea has not only been applied in software system vulnerability scanning and service and version leakage prevention, but also gradually obtained large-scale anti-fingerprint detection and identification of remote operating systems. promote.

In 2011, the research of MTD thought on the prevention and security of the fingerprint identification system of the operating system mainly focused on the randomization of the IP address configuration within a certain period, so that the fingerprint detection party could not complete the information collection within the time window of the IP conversion of the target host. and probing. In 2013, the research began to periodically modify and protect the characteristic values of the TCP protocol stack on the MTD in the field of remote operating system fingerprinting. However, due to the security flaws and hidden dangers of the periodic MTD protection itself, if the detection party uses the method of detecting only one feature in each cycle, and uses multiple cycles to summarize the detection results of each feature, the MTD protection can be The security mechanism and performance of the system are greatly reduced. In addition, if the fingerprint detection party adopts distributed detection and information collection, the attack surface faced by MTD will be more difficult to prevent, the situation against fingerprint detection will be more complicated, and the defects of periodic MTD protection will be more prominent.

Contents of the invention

The technical problem to be solved by the present invention is to provide an event-triggered MTD protection system and method for the deficiencies of the prior art.

The technical solution of the present invention to solve the above-mentioned technical problems is as follows: an event-triggered MTD protection system, including a fingerprint detection packet judgment system, a fingerprint detection event judgment system and a characteristic value MTD modification system;

The fingerprint detection packet judging system is used to judge whether the data packet belongs to a normal service data packet or a fingerprint detection packet belonging to the characteristics of the detection system when receiving a request packet sent from a client, if it is determined If the data packet is requested for a normal system business connection, it will respond directly without any processing without triggering the protection mechanism; if it is determined to be a detection packet aimed at obtaining the current system characteristics and corresponding characteristic values, the protection mechanism will be triggered immediately to ensure the integrity of the system characteristic information. Do not leak;

The fingerprint detection event judging system is used to collect, store and judge fingerprint detection events. When it is judged that the detection data packet has been received, it first compares in the fingerprint detection event set, whether it is already in the current event set, and if it exists, then Execute according to the processing method of the current event; if it does not exist, randomize and modify the value of the detection package’s desired detection characteristics, and then define a new event record for this type of detection behavior and store it;

The characteristic value MTD modification system is used to perform randomization or Boolean transformation on the value of the detected part of the characteristic within a certain range by using the MTD idea after it is determined to be a fingerprint detection behavior, and then encapsulate the changed characteristic value into The response packet is returned to the fingerprint detection party.

The beneficial effects of the present invention are: the beneficial effects of the present invention are: the present invention adopts the event-triggered MTD against the operating system fingerprint identification mechanism, through the analysis of the operating system active fingerprint identification method and the detection packet, formulates the detection event set, and designs a Event-triggered MTD (the protection idea of hiding the characteristics of the operating system. In this way, each time the protected target (Target) receives the detection data packet from the fingerprint detection party (Fingerprinter), it will automatically change the corresponding characteristics of the detection item, so that the detection party collects The detected fingerprint features are wrong information, so that they can be deceived or confused as other types of equipment, and finally some important basic equipment can obtain an effective anti-remote fingerprint identification protection mechanism.

Another technical solution of the present invention to solve the above-mentioned technical problems is as follows: an event-triggered MTD protection method includes the following steps:

Use the fingerprint detection packet to determine when the system receives the request data packet from the client, it will judge whether the data packet belongs to the normal business data packet or the fingerprint detection packet that belongs to the detection system characteristics, and if it is determined to be a normal system business connection If the data packet is requested, it will respond directly without any processing without triggering the protection mechanism; if it is determined to be a detection packet aimed at obtaining the current system characteristics and corresponding characteristic values, the protection mechanism will be triggered immediately to ensure that the system characteristic information is not leaked;

Use the fingerprint detection event judgment system to collect, store and judge fingerprint detection events. When it is judged that the detection data packet has been received, it will first be compared in the fingerprint detection event set to see if it is already in the current event set. If it exists, it will be processed according to the current event. The method corresponds to the execution; if it does not exist, randomize and modify the value of the detection feature that the detection package wants to detect, and then define a new event record for this type of detection behavior and store it;

Using characteristic value MTD to modify the system After determining that it is a fingerprint detection behavior, use the MTD idea to perform randomization or Boolean transformation on the value of the detected part of the characteristic within a certain range, and then encapsulate the changed characteristic value into a response packet and return it to Fingerprint detector.

Description of drawings

Fig. 1 is a schematic diagram of an event-triggered MTD protection system of the present invention;

Fig. 2 is a schematic diagram of the fingerprint detection package determination system of the present invention;

Fig. 3 is a schematic diagram of the fingerprint detection event judging system of the present invention;

Fig. 4 is a schematic diagram of the characteristic value MTD modification system system of the present invention;

5 is a flowchart of an event-triggered MTD protection method according to the present invention;

Fig. 6 is a program flow chart of the fingerprint detection package judging system of the present invention;

Fig. 7 is a flow chart of the fingerprint detection event judging program of the present invention;

Fig. 8 is a flow chart of the program for modifying the characteristic value MTD according to the present invention.

Detailed ways

The principles and features of the present invention are described below in conjunction with the accompanying drawings, and the examples given are only used to explain the present invention, and are not intended to limit the scope of the present invention.

The invention relates to an event-triggered MTD (Moving Target Defense) protection system against Remote Operating System Fingerprinting. Through the analysis of the active fingerprint identification method and the detection package of the operating system, the detection event set is formulated, and an event-triggered MTD protection idea of hiding the characteristics of the operating system is designed. Realize that the protected target (Target) automatically changes the corresponding characteristics of the detection item every time it receives the detection data packet from the fingerprint detection party (Fingerprinter), so that the fingerprint characteristics collected by the detection party are wrong information, so that it is deceived or confused. For other types of equipment, some important basic equipment will finally get an effective protection mechanism against remote fingerprint identification.

As shown in Figure 1, an event-triggered MTD protection system includes a fingerprint detection host (fingerprinter), a detected target host (target) and a fingerprint detection MTD protection system, wherein the fingerprint detection MTD protection system is deployed on the detected target host Above, it includes the fingerprint detection package determination system, the fingerprint detection event determination system and the characteristic value MTD modification system.

The fingerprint detection packet judging system is used for judging whether the data packet belongs to a normal service data packet or a fingerprint detection packet belonging to a detection system characteristic when receiving a request data packet from a client. If it is determined to be a normal system service connection request packet, it will respond directly without any processing without triggering the protection mechanism; if it is determined to be a detection packet aimed at obtaining the current system characteristics and corresponding characteristic values, the protection mechanism will be triggered immediately to ensure the system characteristics non-disclosure of information;

The fingerprint detection event judging system is used to collect, store and judge fingerprint detection events. When it is judged that the detection data packet has been received, it first compares in the fingerprint detection event set, whether it is already in the current event set, and if it exists, then Execute according to the processing method of the current event; if it does not exist, randomize and modify the value of the detection package’s desired detection characteristics, and then define a new event record for this type of detection behavior and store it;

The characteristic value MTD modification system is used to perform randomization or Boolean transformation on the value of the detected part of the characteristic within a certain range by using the MTD idea after it is determined to be a fingerprint detection behavior, and then encapsulate the changed characteristic value into The response packet is returned to the fingerprint detection party.

When the characteristic value MTD modification system is Boolean, it can not only use the current non-operation to change the characteristic value, but also use the randomization of non-, exclusive-or and other operations, so that the detection party can better understand the Boolean characteristic value Fingerprints the protected operating system. The detection event set is shown in Table 1.

Table 1

The core of the present invention is whether the current data packet belongs to the detection packet and which type of detection it belongs to.

As shown in Figure 2, described fingerprint detection packet judging system comprises data packet parsing module, data packet type discriminating module, data packet destination port discriminating module, data packet content discriminating module and data packet feature discriminating module; Described data packet parsing module It is used to analyze the received request data packet, unpack the packet to view the packet header, destination address, destination port, data packet type, data packet content, etc., and provide source data for subsequent identification modules; the data The packet type discrimination module, the data packet destination port discrimination module and the data packet content discrimination module cooperate with each other to complete the determination of whether the data packet is a normal service packet or a fingerprint detection data packet, thereby deciding whether to trigger the fingerprint detection event set and the MTD modification system; The data packet feature discrimination module is combined with the source data provided by the data packet type discrimination module, the data packet destination port discrimination module, the data packet content discrimination module and the data packet feature discrimination module, etc., to determine which detection type the current fingerprint detection belongs to.

As shown in Figure 3, the fingerprint detection event judgment system includes a detection type discrimination module, a detection event database and a detection event classification module; It is mainly divided into four types: ICMP, IP, TCP and UDP, and then the detection data packet is passed to the fingerprint detection event determination system for subsequent operations. The detection event database is a pre-stored event feature set detected by different protocols of IP, TCP, UDP and ICMP; the detection event classification module is used to match the data judged by the detection type discrimination module with the detection event database, if If it matches one of the items successfully, execute the execution steps of the MTD modification system corresponding to the event. If it cannot match one of the items successfully, add an event rule to the current detection type according to the format of the event database, and finally save this detection The type of feature to be probed is passed to the next step of the MTD modification system for feature values.

As shown in Figure 4, the characteristic value MTD modification system includes a value modification module of the corresponding characteristic; the MTD modification system of the characteristic value is to deceptively modify the characteristic value to be detected by the current detection packet, if it is a value, Then perform randomization within the specified range; if it is a Boolean value, the current Boolean value will be negated. Finally, the modified result is encapsulated in the response packet format and returned to the fingerprint detection party.

As shown in Figure 5, an event-triggered MTD protection method includes the following steps:

Use the fingerprint detection packet to determine when the system receives the request data packet from the client, it will judge whether the data packet belongs to the normal business data packet or the fingerprint detection packet that belongs to the detection system characteristics, and if it is determined to be a normal system business connection If the data packet is requested, it will respond directly without any processing without triggering the protection mechanism; if it is determined to be a detection packet aimed at obtaining the current system characteristics and corresponding characteristic values, the protection mechanism will be triggered immediately to ensure that the system characteristic information is not leaked;

Use the fingerprint detection event judgment system to collect, store and judge fingerprint detection events. When it is judged that the detection data packet has been received, it will first be compared in the fingerprint detection event set to see if it is already in the current event set. If it exists, it will be processed according to the current event. The method corresponds to the execution; if it does not exist, randomize and modify the value of the detection feature that the detection package wants to detect, and then define a new event record for this type of detection behavior and store it;

Using characteristic value MTD to modify the system After determining that it is a fingerprint detection behavior, use the MTD idea to perform randomization or Boolean transformation on the value of the detected part of the characteristic within a certain range, and then encapsulate the changed characteristic value into a response packet and return it to Fingerprint detector.

As shown in Figure 6, the data packet analysis module, the data packet type discrimination module, the data packet destination port discrimination module and the data packet content discrimination module cooperate with each other to complete the determination process of whether the data packet is a normal service data packet or a malicious detection packet as follows:

Step 1.1: The data packet parsing module module decapsulates the data packet;

Step 1.2: The data packet type discrimination module judges which protocol type data packet among ICMP, TCP, UDP and IP the current data packet belongs to. If it is the ICMP protocol, directly define the current packet as a detection packet, perform step 1.5 and define the current detection packet type label (tag) as ICMP; if it is the IP protocol, perform the packet content discrimination module of step 1.4; if it is TCP or UDP protocol, then perform step 1.3 data packet destination port discrimination module;

Step 1.3: The data packet target port discrimination module judges whether the target port in the data packet is open, if it is open, execute the step 1.4 data packet content discrimination module; if it is closed, then define the current data packet as a detection packet, and execute the step 1.5, and define the current detection packet type label (tag) as TCP or UDP according to the protocol type;

Step 1.4: The data packet content discrimination module discriminates the data part in the data packet, if the data is empty, then the current data packet is defined as a detection packet, and step 1.5 is performed; if the data packet is not empty, then the current data packet is considered to be Normal business data packets and normal return response data packets;

Step 1.5: The detection type discrimination module classifies the detection data packet according to the protocol type, and the type label (tag) is mainly divided into four types: ICMP, IP, TCP and UDP, and then the detection data packet is passed to the fingerprint detection event determination system for subsequent operations.

As shown in FIG. 7 , the detection event database is a pre-stored event signature set of different protocols such as IP, TCP, UDP and ICMP. The detection event classification module is used to match the data judged by the detection type discrimination module with the detection event database, if the matching is successful with one of them, then execute the execution steps of the MTD modification system corresponding to the event, if it cannot be matched with one of them If the item matches successfully, add an event rule according to the format of the event database for the current detection type, and finally pass the characteristics to be detected by this detection type to the MTD modification system of the next feature value;

The said a fingerprint detection event judging system is characterized in that the process of the detection event classification module and the detection event database judging which detection event the current detection data packet belongs to is as follows:

Step 2.1: Match the detection type tag of the detection data packet with the detection event database. If it is a known detection event, perform step 2.2. If it is an unknown detection event, add the current detection type according to the format of the event database An event rule, and finally pass the characteristics to be detected of this detection type to the MTD modification system of the characteristic value in the next step;

Step 2.2: According to the matching of the detection type tag in step 2.1 and the detection event database, it is determined that the current detection event is a known detection event contained in the current database, a step of switch matching is performed, and the corresponding MTD characteristic modification steps are performed according to different types of tags; For example, when a TCP detects an event, the MTD characteristic modification is performed by modifying the initial sequence number (ISN, initial sequence number) of the characteristic value generated in the current TCP.

As shown in Figure 8, the MTD modification system of the characteristic value is to deceptively modify the characteristic value to be detected by the current detection packet. If it is a numerical value, randomization is performed within a specified range; if it is a Boolean value, Then the current Boolean value is negated. Finally, the modified result is encapsulated in the response packet format and returned to the fingerprint detection party.

The MTD modification system of a characteristic value is characterized in that, the various detection events correspond to the characteristic values that want to be detected, and the process of realizing deceptive modification is as follows:

Step 3.1: Determine whether the characteristic value corresponding to the detection event is Boolean or not;

Step 3.2: If it is a Boolean type, perform a one-step negation operation to reverse the current characteristic value, thereby deceiving the detection result. If it is not a Boolean type, perform step 3.3;

Step 3.3: According to step 3.2, it is determined that the characteristic value of the current detection is not a Boolean type, but a numerical value, then execute the randomization algorithm, and perform a randomization transformation on the current characteristic value within a range that does not affect the normal system, so that the detection result Every time there is no law, to achieve confusion on the detection results;

Step 3.4: Encapsulate the modified characteristic value into a data packet and return it to the detecting party.

Described a kind of event-triggered MTD protection system is characterized in that, the detection packet may contain the detection of several characteristic values under a protocol at the same time, and the gist of the present invention is to pass the detection of each characteristic value Defined as an event, the determination of each detection event and MTD spoofing modification are independent from other events, so that the possibility of detecting the correct fingerprint of the current operating system by synthesizing the results of multiple detection events represented by Nmap is greatly reduced.

As shown in FIG. 1 , using the event-triggered MTD protection system of the present invention, the protected host can deceive and confuse the attacker's operating system fingerprint detection and identification. According to the communication process of establishing connections between the protected host and other hosts, all the protection processes are generally divided into three scenarios:

That is, Scenario 1 (normal business data communication Client-related protocol request TCP connection Target, after the MTD protection system detects that the current data packet is not a detection packet, it will be returned to the Client as a normal response packet);

Scenario 2 (the fingerprint detection party Fingerprinter sends a SYN detection packet with empty data in the TCP protocol to the target host Target, after the MTD protection system detects that the current data packet is a detection packet, triggers the fingerprint identification MTD system, and performs the corresponding detection characteristic value After modification, the package is returned to Fingerprinter);

Scenario 3 (the fingerprint detection party Fingerprinter sends a detection packet in the UDP protocol, in which the target port is a closed port on the Target host, after the MTD protection system detects that the current data packet is a detection packet, triggers the fingerprint recognition MTD system, and detects the corresponding detection event Modify the port to be open, encapsulate the corresponding UDP package and return it to Fingerprinter).

Scenario 1, normal Client requests to establish communication with the target host without triggering the MTD protection mechanism, the specific steps are as follows:

1) Client first sends a TCP SYN packet to the target host Target;

2) Target decapsulates the data packet through the data packet analysis module in the event-triggered MTD protection system;

3) the data packet type discrimination module identifies that the current data packet is a TCP protocol type;

4) The data packet content discrimination module identifies that the content of the current TCP data packet is not empty and is not a detection packet, so that it is not necessary to trigger detection and protection mechanisms for detection events;

5) Finally, return the TCP SYN packet to the ACK+SYN packet according to the normal business return packet type.

Scenario 2, Target against Fingerprinter's TCP SYN detection packet, the specific steps are as follows:

1) Fingprinter sends a TCP SYN detection packet to the target host Target, in which the data part data is empty;

2) Target decapsulates the data packet through the data packet analysis module in the event-triggered MTD protection system;

3) the data packet type discrimination module identifies that the current data packet is a TCP protocol type;

4) the target port of the data packet target port judging module identifying the current packet is open;

5) The data packet content discrimination module recognizes that the content of the current TCP data packet is empty, and then determines that it is a detection packet, which triggers the detection and protection mechanism of the detection event;

6) The data packet feature discrimination module defines the type tag of the current detection packet as TCP SYN detection, and passes the parameters to the fingerprint detection event judgment system;

7) The fingerprint detection event judgment system detects according to the TCP SYN detection in the tag of the detection packet, matches with the detection event database and learns that the current detection event is a currently known detection event;

8) The fingerprint detection event judgment system matches the switch, and the characteristic values corresponding to the current TCP SYN detection event include ISN (initial sequence number, 32bit), ACK number (32bit), urgent pointer (16bit), window size (16bit), SYN (1bit), checksum (16bit) in flags, the parameters are passed to the MTD modification system of the characteristic value;

9) MTD modification of characteristic values The system judges whether each characteristic of ISN, ACK number, urgent pointer, windowsize, and SYN (1bit) and checksum in flags is a Boolean value. Only the SYN (1bit) in flags is judged to be a Boolean value. All other properties are numeric values;

10) The MTD modification system of characteristic values performs negation on the SYN value in the current flags, and performs randomized calculation on the values of other characteristics;

11) MTD modification of characteristic value The system encapsulates the modified characteristic value into ACK+SYN and returns it to Fingerprinter.

Scenario 3, Target resists Fingerprinter's UDP to close the detection packet of the target port, including the following operations:

1) Fingprinter sends a UDP detection packet to the target host Target, where the target port is the closed port of the Target;

2) Target decapsulates the data packet through the data packet analysis module in the event-triggered MTD protection system;

3) the data packet type discrimination module identifies that the current data packet is a UDP protocol type;

4) the destination port of the data packet target port judgment module identifies that the target port of the current data packet is closed, and the current data packet is defined as a detection packet;

5) The data packet feature discrimination module defines the type tag of the current detection packet as UDP detection, and passes the parameters to the fingerprint detection event determination system;

6) The fingerprint detection event determination system passes switch matching, and the characteristic values corresponding to the detection of the current TCP SYN detection event include IPID (identification, 16bit) and length (16bit), and the parameters are passed to the MTD modification system of the characteristic value;

7) The MTD modification system of the characteristic value judges whether the two characteristics of IP ID and length are Boolean values, and the characteristics are all numerical values;

8) The MTD modification system of the characteristic value performs randomized calculation on the value of the current characteristic;

9) MTD modification of characteristic value The system encapsulates the modified characteristic value into a UDP response packet and returns it to Fingerprinter.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (9)

1. a MTD guard system for event-triggered, is characterized in that, comprises fingerprint detection bag decision-making system, fingerprint detection event decision-making system and characteristic value MTD and revises system;

Described fingerprint detection bag decision-making system, when it is for receiving the request data package sent from client, carry out the differentiation of the types such as fingerprint detection bag regular traffic packet being belonged to packet or belongs to detection system characteristic, if it is determined that be normal system service connection request packet, be then left intact and directly respond and do not trigger preventing mechanism; If it is determined that for being intended to the detection packet obtaining current system characteristic and corresponding characteristic value, then triggering preventing mechanism at once, guarantee not leaking of system-specific information;

Described fingerprint detection event decision-making system, it is for collecting, storing and judge the event of fingerprint detection, when judging to have received probe data packet, and first comparison in fingerprint detection event set, whether concentrate in current event, if existed, perform by the processing method correspondence of current event; If do not existed, then detection packet wanted the value of detection feature to carry out randomization amendment, then such detection behavior defined a newly-increased logout and store;

Described characteristic value MTD revises system, it is for after being judged to be fingerprint detection behavior, utilize MTD thought, randomization or boolean's conversion are performed within the specific limits to the value being detected part of properties, then the characteristic value after change is packaged into response data packet and returns to fingerprint detection side.

2. the MTD guard system of a kind of event-triggered according to claim 1, it is characterized in that, described fingerprint detection bag decision-making system comprises packet parsing module, type of data packet discrimination module, data packet destination port discrimination module, packet content discrimination module and packet feature decision module;

Described packet parsing module is for resolving the request data package received, and the encapsulation of taking bag apart, to check the packet header, destination address, destination interface, type of data packet, packet content etc. of packet, is the module providing source data of follow-up differentiation;

Described type of data packet discrimination module, the packet that cooperatively interacted between data packet destination port discrimination module and packet content discrimination module are the judgements of regular traffic bag or fingerprint detection packet, thus determine whether trigger fingerprint detection event set and MTD amendment system;

Described packet feature decision module is the source data provided in conjunction with type of data packet discrimination module, data packet destination port discrimination module and packet content discrimination module and packet feature decision module etc., judges current finger print detection belongs to which kind of detection type.

3. the MTD guard system of a kind of event-triggered according to claim 1, is characterized in that, described fingerprint detection event decision-making system comprises detection type identification module, detection event data storehouse and detection event sort module;

Described detection type identification module, for classifying by protocol type to probe data packet, passes to fingerprint detection event decision-making system by probe data packet;

Described detection event data storehouse, the affair character collection of IP, TCP, UDP and ICMP different agreement stored in advance detection;

Described detection event sort module, for the data of detection type identification module judgement and detection event data storehouse are matched, if with wherein one the match is successful, then perform the execution step that MTD corresponding to this event revises system, if can not with wherein one the match is successful, then current detection type is pressed the newly-increased event rules of form of event database, the MTD finally characteristic that this detection type will detect being passed to next step characteristic value revises system.

4. the MTD guard system of a kind of event-triggered according to claim 1, is characterized in that, described characteristic value MTD revises the value change module that system comprises corresponding characteristic; The MTD of described characteristic value revises system, is that the characteristic value that current detection packet will be detected carries out fraudulent modification, if a numerical value, then in specified scope, performs randomization; If a Boolean, then current Boolean is carried out inverse.Finally amended result is encapsulated by response data packet format, return to fingerprint detection side.

5. a MTD means of defence for event-triggered, is characterized in that, comprise the steps:

When utilizing fingerprint detection bag decision-making system to receive the request data package sent from client, carry out the differentiation of the types such as fingerprint detection bag regular traffic packet being belonged to packet or belongs to detection system characteristic, if it is determined that be normal system service connection request packet, be then left intact and directly respond and do not trigger preventing mechanism; If it is determined that for being intended to the detection packet obtaining current system characteristic and corresponding characteristic value, then triggering preventing mechanism at once, guarantee not leaking of system-specific information;

Utilize fingerprint detection event decision-making system to collect, store and judge the event of fingerprint detection, when judging to have received probe data packet, whether first comparison in fingerprint detection event set, concentrate in current event, if existed, performs by the processing method correspondence of current event; If do not existed, then detection packet wanted the value of detection feature to carry out randomization amendment, then such detection behavior defined a newly-increased logout and store;

Utilization level value MTD revises system after being judged to be fingerprint detection behavior, utilize MTD thought, randomization or boolean's conversion are performed within the specific limits to the value being detected part of properties, then the characteristic value after change is packaged into response data packet and returns to fingerprint detection side.

6. the MTD means of defence of a kind of event-triggered according to claim 5, is characterized in that, decision data bag is that the decision process of regular traffic packet or malice detection packet is as follows:

Step 1.1: packet parsing module module carries out decapsulation to packet;

Step 1.2: the protocol type of type of data packet discrimination module to current data packet differentiates, if ICMP agreement, directly current data packet is defined as detection packet, performs step 1.5 and current detection packet type label is defined as ICMP; If IP agreement, perform the packet content discrimination module of step 1.4; If TCP or udp protocol, then perform step 1.3 data packet destination port discrimination module;

Step 1.3: whether data packet destination port discrimination module opens target port in packet differentiates, if open, performs step 1.4 packet content discrimination module; If close, then current data packet is defined as detection packet, performs step 1.5, and according to protocol type, current detection packet type label is defined as TCP or UDP;

Step 1.4: packet content discrimination module differentiates the data division in packet, if data are empty, is then defined as detection packet by current data packet, performs step 1.5; If packet is not empty, then think that current data packet is that normal business data packet also normally returns response data packet;

Step 1.5: detection type identification module is classified by protocol type to probe data packet, and type label is mainly divided into ICMP, IP, TCP and UDP tetra-kinds, then probe data packet passes to fingerprint detection event decision-making system and carries out subsequent operation.

7. the MTD means of defence of a kind of event-triggered according to claim 5, is characterized in that, judges that current probe data packet belongs to the process of which kind of detection event as follows:

Step 2.1: the detection type tag according to probe data packet mates with detection event data storehouse, if known detection event, then perform step 2.2, if the detection event of the unknown, then current detection type is pressed the newly-increased event rules of form of event database, the MTD finally characteristic that this detection type will detect being passed to next step characteristic value revises system;

Step 2.2: to mate with detection event data storehouse according to the detection type tag in step 2.1 and judge that current detection event comprises known detection event in current database, perform a step switch coupling, perform corresponding MTD characteristic modify steps according to dissimilar tag.

8. the MTD means of defence of a kind of event-triggered according to claim 5, is characterized in that, described various detection event correspondence wants the characteristic value detected, and realizing fascinating process is:

Step 3.1: whether the characteristic value of detection event correspondence detection is that Boolean type differentiates;

Step 3.2: if Boolean type, then perform a step inverse, by current characteristic value changeabout, thus realize the deception to result of detection, if not Boolean type, then perform step 3.3;

Step 3.3: judge that the characteristic value of current detection is not Boolean type by step 3.2, but a numerical value, then perform randomized algorithm, by current characteristic value in one the not normal scope of influential system, carry out randomizing transform, make result of detection not have rule at every turn, realize obscuring result of detection;

Step 3.4: amended characteristic value is carried out being packaged into packet and returns to detection side.

9. the MTD means of defence of a kind of event-triggered according to claim 5, it is characterized in that, the detection of described probe data packet several characteristic value under simultaneously comprising a kind of agreement, by the detection of each characteristic value is defined as an event, the judgement of each detection event and MTD deception amendment are opened with other indie incidents.