CN116032582A - Network intrusion prevention method and system for port scanning - Google Patents
Network intrusion prevention method and system for port scanning Download PDFInfo
- Publication number
- CN116032582A CN116032582A CN202211639079.3A CN202211639079A CN116032582A CN 116032582 A CN116032582 A CN 116032582A CN 202211639079 A CN202211639079 A CN 202211639079A CN 116032582 A CN116032582 A CN 116032582A
- Authority
- CN
- China
- Prior art keywords
- port
- source address
- flow
- message
- sdn controller
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002265 prevention Effects 0.000 title claims abstract description 29
- 238000000034 method Methods 0.000 title claims abstract description 25
- 238000012795 verification Methods 0.000 claims abstract description 23
- 238000004458 analytical method Methods 0.000 claims abstract description 5
- 238000007405 data analysis Methods 0.000 claims description 6
- 230000008569 process Effects 0.000 claims description 6
- 238000001514 detection method Methods 0.000 description 5
- 241000191291 Abies alba Species 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 230000007123 defense Effects 0.000 description 2
- 230000003111 delayed effect Effects 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
Images
Classifications
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a network intrusion prevention method and a system aiming at port scanning, belonging to the technical field of network security protection, wherein the method comprises the following steps: step S10, the SDN controller acquires statistical data of all flows from the connected OpenFlow switch, analyzes the statistical data to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database; step S20, the SDN controller performs malicious flow verification based on the source address, the target address, the port and the message quantity, and adds the source address corresponding to the malicious flow into a blacklist; step S30, when the OpenFlow switch receives the data message, the data message is sent to the SDN controller through a PacketIn message; and S40, the SDN controller analyzes the received data message to obtain a source address, a target address and a port, checks the source address, the target address and the port obtained by analysis through a database, and updates a flow table in the OpenFlow switch. The invention has the advantages that: the resource consumption of network intrusion prevention is greatly reduced.
Description
Technical Field
The invention relates to the technical field of network security protection, in particular to a network intrusion prevention method and system aiming at port scanning.
Background
Security has become a non-negligible problem for computer networks due to resource abuse and malicious traffic intrusion. Before a network or system is attacked, a port scan is typically received from an attacker, from which the attacker obtains relevant vulnerabilities for subsequent attacks.
Port scanning is typically the orderly transmission of various network packets by an attacker to a target host (or target network), and by analyzing the response messages of the target host, the attacker can grasp relevant information attributes that contribute to network attacks, such as open ports, firewall information, network topology, etc. The port scan may be classified into a lateral port scan that scans the same port of different target hosts and a longitudinal port scan that scans multiple different ports of the same target host.
For network intrusion by port scanning, traffic is conventionally analyzed by an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS) to detect whether malicious activity exists, but the IDS and the IPS need to analyze a message carried by the traffic first and then route the message, which may cause additional switching delay (i.e., message transmission delay), because the message is copied to the additional IDS for analysis, and may also cause performance consumption on the network.
Therefore, how to provide a network intrusion prevention method and system for port scanning, so as to reduce the resource consumption of network intrusion prevention, is a technical problem to be solved urgently.
Disclosure of Invention
The invention aims to solve the technical problem of providing a network intrusion prevention method and a system aiming at port scanning, which can reduce the resource consumption of network intrusion prevention.
In a first aspect, the present invention provides a network intrusion prevention method for port scanning, including the steps of:
step S10, an SDN controller acquires statistical data of all flows from a connected OpenFlow switch, analyzes the statistical data to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database;
step S20, the SDN controller performs malicious flow verification based on the source address, the target address, the port and the message quantity, and adds the source address corresponding to the malicious flow into a blacklist;
step S30, when the OpenFlow switch receives a data message, the data message is sent to the SDN controller through a PacketIn message;
and step S40, the SDN controller analyzes the received data message to obtain a source address, a target address and a port, checks the source address, the target address and the port obtained by analysis through the database, and updates a flow table in the OpenFlow switch.
Further, the step S10 specifically includes:
the SDN controller periodically requests a flow statistic device from the connected OpenFlow switch through an API, further acquires statistic data of all flows, analyzes the statistic data in real time to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database of the SDN controller.
Further, the step S20 specifically includes:
step S21, the SDN controller sets a message number threshold, a first access number threshold and a second access number threshold, judges whether the message number of each flow is smaller than or equal to the message number threshold, and if yes, enters step S22; if not, the description is not a malicious stream, and the process proceeds to step S30;
step S22, the SDN controller judges whether the number of the same ports accessing different target addresses exceeds a first access number threshold, if so, the corresponding flow is a malicious flow scanned by a transverse port, and the source address corresponding to the malicious flow is added into a blacklist; if not, go to step S23;
step S23, classifying the ports into hot ports and cold ports based on the scanning frequency of the ports by the SDN controller, carrying out weighted calculation on the access quantity of the hot ports and the cold ports under the same target address through a weighted formula to obtain weighted access times, judging whether the weighted access times exceed a second access quantity threshold, if so, explaining that the corresponding flow is a malicious flow scanned by the longitudinal port, and adding the source address corresponding to the malicious flow into a blacklist; if not, it is determined that there is no malicious flow, and the process proceeds to step S30.
Further, the step S30 specifically includes:
when the OpenFlow switch receives a data message, judging whether the data message is a SYN message or not through a PacketIn message, and if so, sending the data message to an SDN controller; if not, discarding the data message, and updating the routing rule of the flow table in the OpenFlow switch based on the discarded data message.
Further, the step S40 specifically includes:
the SDN controller analyzes the received data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, if yes, adds a discarding rule aiming at the source address of the data message into a flow table in an OpenFlow switch; if not, adding a forwarding rule aiming at the source address of the data message in a flow table in the OpenFlow switch.
In a second aspect, the present invention provides a network intrusion prevention system for port scanning, including:
the statistical data analysis module is used for acquiring statistical data of all flows from the connected OpenFlow switch by the SDN controller, analyzing the statistical data to obtain a source address, a target address, a port and the number of messages and storing the source address, the target address, the port and the number of messages in a database;
the malicious flow verification module is used for carrying out malicious flow verification by the SDN controller based on the source address, the target address, the port and the message quantity, and adding the source address corresponding to the malicious flow into a blacklist;
the data message forwarding module is used for sending the data message to the SDN controller through a PacketIn message when the OpenFlow switch receives the data message;
and the flow table updating module is used for analyzing the received data message by the SDN controller to obtain a source address, a target address and a port, checking the analyzed source address, target address and port through the database, and updating the flow table in the OpenFlow switch.
Further, the statistical data analysis module is specifically configured to:
the SDN controller periodically requests a flow statistic device from the connected OpenFlow switch through an API, further acquires statistic data of all flows, analyzes the statistic data in real time to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database of the SDN controller.
Further, the malicious flow verification module specifically includes:
the SDN controller is used for setting a message quantity threshold, a first access quantity threshold and a second access quantity threshold, judging whether the message quantity of each flow is smaller than or equal to the message quantity threshold, and entering a transverse scanning verification unit if the message quantity of each flow is smaller than or equal to the message quantity threshold; if not, indicating that the flow is not malicious and entering a data message forwarding module;
the transverse scanning verification unit is used for judging whether the number of the same ports accessing different target addresses exceeds a first access number threshold value or not by the SDN controller, if so, the corresponding flow is a malicious flow scanned by the transverse ports, and the source address corresponding to the malicious flow is added into a blacklist; if not, entering a longitudinal scanning checking unit;
the longitudinal scanning verification unit is used for classifying the ports into hot ports and cold ports based on the scanning frequency of the ports by the SDN controller, carrying out weighted calculation on the access quantity of the hot ports and the cold ports under the same target address through a weighted formula to obtain weighted access times, judging whether the weighted access times exceed a second access quantity threshold value, if so, indicating that the corresponding flow is a malicious flow scanned by the longitudinal ports, and adding the source address corresponding to the malicious flow into a blacklist; if not, the malicious flow is not existed, and the data message forwarding module is accessed.
Further, the data message forwarding module is specifically configured to:
when the OpenFlow switch receives a data message, judging whether the data message is a SYN message or not through a PacketIn message, and if so, sending the data message to an SDN controller; if not, discarding the data message, and updating the routing rule of the flow table in the OpenFlow switch based on the discarded data message.
Further, the flow table updating module is specifically configured to:
the SDN controller analyzes the received data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, if yes, adds a discarding rule aiming at the source address of the data message into a flow table in an OpenFlow switch; if not, adding a forwarding rule aiming at the source address of the data message in a flow table in the OpenFlow switch.
The invention has the advantages that:
analyzing the statistical data to obtain a source address, a target address, a port and the number of messages and storing the source address, the target address, the port and the number of messages in a database by acquiring the statistical data of all flows in an SDN network, judging whether the source address, the target address, the port and the number of messages are malicious flows scanned by a transverse port or a longitudinal port or not by an SDN controller, and adding the source address corresponding to the malicious flows into a blacklist of a flow table; when the OpenFlow switch receives the data message, the data message of the non-SYN message is filtered through the PacketIn message and then sent to the SDN controller; the SDN controller analyzes the data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, and further updates a flow table in the OpenFlow switch, namely, adopts a non-invasive method to maliciously check a flow scanned by the port, dynamically updates the flow table of the OpenFlow switch to ensure network safety, is lighter than traditional invasive IDS and IPS, has low network resource consumption, memory occupation and power consumption during data processing, further greatly reduces resource consumption of network intrusion defense, and also avoids extra exchange delay because the message content is not required to be analyzed first and then the message route is performed.
Drawings
The invention will be further described with reference to examples of embodiments with reference to the accompanying drawings.
Fig. 1 is a flow chart of a network intrusion prevention method for port scanning according to the present invention.
Fig. 2 is a schematic diagram of a network intrusion prevention system for port scanning according to the present invention.
Detailed Description
According to the technical scheme in the embodiment of the application, the overall thought is as follows: and carrying out malicious verification on the port-scanned flow by adopting a non-invasive method, and dynamically updating the flow table of the OpenFlow switch to ensure network security, thereby replacing the traditional invasive IDS and IPS and reducing the resource consumption of network intrusion prevention.
Referring to fig. 1 to 2, a preferred embodiment of a network intrusion prevention method for port scanning according to the present invention includes the following steps:
step S10, an SDN controller acquires statistical data of all flows from a connected OpenFlow switch, analyzes the statistical data to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database;
step S20, the SDN controller performs malicious flow verification based on the source address, the target address, the port and the message quantity, and adds the source address corresponding to the malicious flow into a blacklist of a flow table;
step S30, when the OpenFlow switch receives a data message, the data message is sent to the SDN controller through a PacketIn message;
and step S40, the SDN controller analyzes the received data message to obtain a source address, a target address and a port, checks the source address, the target address and the port obtained by analysis through the database, and updates a flow table in the OpenFlow switch.
Abstracting data having common characteristics or attributes over the same network at the same time into one stream, for example, regarding data accessing the same destination address as one stream, the stream is generally defined by a network administrator, and different policies can be executed according to different streams; in the OpenFlow system, data is handled in units of flows. A flow table is a collection of policy entries for a particular flow, responsible for the lookup and forwarding of packets, and a single flow table includes a series of flow entries (flowports).
The step S10 specifically includes:
the SDN controller periodically requests a flow statistic device from the connected OpenFlow switch through an API, so that statistic data of all flows in the SDN network are obtained, and the statistic data are analyzed in real time to obtain a source address, a target address, a port and the number of messages and are stored in a database of the SDN controller.
The SDN controller acquires statistical data with a period of 3 seconds, the attack detection is delayed due to the overlong period, and the traffic load is increased due to the excessively short period.
Software Defined Networking (SDN) is a new paradigm in today's computer networks, separating the control logic of the network from the underlying devices, controlling the entire network using a logically centralized SDN controller; the OpenFlow protocol is an open source implementation of SDN for communication between an SDN controller and a switch; the SDN controller can acquire network real-time conditions through intermittent OpenFlow messages, and the invention uses the network real-time conditions to realize the detection and the prevention of intrusion.
The step S20 specifically includes:
step S21, the SDN controller sets a message number threshold, a first access number threshold and a second access number threshold, judges whether the message number of each flow is smaller than or equal to the message number threshold, and if yes, enters step S22; if not, the description is not a malicious stream, and the process proceeds to step S30;
the message number threshold is preferably 5, because there are only three messages (such as SYN, SYN/ACK, ACK of TCP connection) in the case of one port scan, and the interval time of port scan is short, and because retransmission may occur for three messages of TCP connection, two more messages need to be considered.
Step S22, the SDN controller judges whether the number of the same ports accessing different target addresses exceeds a first access number threshold, if so, the corresponding flow is a malicious flow scanned by a transverse port, and the source address corresponding to the malicious flow is added into a blacklist; if not, go to step S23; since the finger scan for one port is not an attack, the first access number threshold is preferably 3;
step S23, classifying the ports into hot ports and cold ports based on the scanning frequency of the ports by the SDN controller, carrying out weighted calculation on the access quantity of the hot ports and the cold ports under the same target address through a weighted formula to obtain weighted access times, judging whether the weighted access times exceed a second access quantity threshold, if so, explaining that the corresponding flow is a malicious flow scanned by the longitudinal port, and adding the source address corresponding to the malicious flow into a blacklist; if not, it is determined that there is no malicious flow, and the process proceeds to step S30.
The weighting formula is specifically as follows: totalweight=a cps+b OPS;
wherein, totalweight represents the weighted access times; CPS represents a hot port; OPS represents a cold gate port; a and b each represent a weight threshold, a is preferably 5, b is preferably 3; the second access number threshold is preferably 15.
The step S30 specifically includes:
when the OpenFlow switch receives a data message, judging whether the data message is a SYN message or not through a PacketIn message, and if so, sending the data message to an SDN controller; if not, discarding the data message, and updating the routing rule of the flow table in the OpenFlow switch based on the discarded data message, thereby preventing ACK/FIN attack and Christmas tree attack.
The step S40 specifically includes:
the SDN controller analyzes the received data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, if yes, adds a discarding rule aiming at the source address of the data message into a flow table in an OpenFlow switch; if not, adding a forwarding rule aiming at the source address of the data message in a flow table in the OpenFlow switch.
Deleting the flow table items in the flow table through a request of an SDN controller or a set timer so as to prevent overflow of the flow table items; the duration of the timer is preferably 15 seconds.
The preferred embodiment of the network intrusion prevention system for port scanning according to the present invention comprises the following modules:
the statistical data analysis module is used for acquiring statistical data of all flows from the connected OpenFlow switch by the SDN controller, analyzing the statistical data to obtain a source address, a target address, a port and the number of messages and storing the source address, the target address, the port and the number of messages in a database;
the malicious flow verification module is used for carrying out malicious flow verification by the SDN controller based on the source address, the target address, the port and the message quantity, and adding the source address corresponding to the malicious flow into a blacklist of a flow table;
the data message forwarding module is used for sending the data message to the SDN controller through a PacketIn message when the OpenFlow switch receives the data message;
and the flow table updating module is used for analyzing the received data message by the SDN controller to obtain a source address, a target address and a port, checking the analyzed source address, target address and port through the database, and updating the flow table in the OpenFlow switch.
Abstracting data having common characteristics or attributes over the same network at the same time into one stream, for example, regarding data accessing the same destination address as one stream, the stream is generally defined by a network administrator, and different policies can be executed according to different streams; in the OpenFlow system, data is handled in units of flows. A flow table is a collection of policy entries for a particular flow, responsible for the lookup and forwarding of packets, and a single flow table includes a series of flow entries (flowports).
The statistical data analysis module is specifically configured to:
the SDN controller periodically requests a flow statistic device from the connected OpenFlow switch through an API, so that statistic data of all flows in the SDN network are obtained, and the statistic data are analyzed in real time to obtain a source address, a target address, a port and the number of messages and are stored in a database of the SDN controller.
The SDN controller acquires statistical data with a period of 3 seconds, the attack detection is delayed due to the overlong period, and the traffic load is increased due to the excessively short period.
Software Defined Networking (SDN) is a new paradigm in today's computer networks, separating the control logic of the network from the underlying devices, controlling the entire network using a logically centralized SDN controller; the OpenFlow protocol is an open source implementation of SDN for communication between an SDN controller and a switch; the SDN controller can acquire network real-time conditions through intermittent OpenFlow messages, and the invention uses the network real-time conditions to realize the detection and the prevention of intrusion.
The malicious flow verification module specifically comprises:
the SDN controller is used for setting a message quantity threshold, a first access quantity threshold and a second access quantity threshold, judging whether the message quantity of each flow is smaller than or equal to the message quantity threshold, and entering a transverse scanning verification unit if the message quantity of each flow is smaller than or equal to the message quantity threshold; if not, indicating that the flow is not malicious and entering a data message forwarding module;
the message number threshold is preferably 5, because there are only three messages (such as SYN, SYN/ACK, ACK of TCP connection) in the case of one port scan, and the interval time of port scan is short, and because retransmission may occur for three messages of TCP connection, two more messages need to be considered.
The transverse scanning verification unit is used for judging whether the number of the same ports accessing different target addresses exceeds a first access number threshold value or not by the SDN controller, if so, the corresponding flow is a malicious flow scanned by the transverse ports, and the source address corresponding to the malicious flow is added into a blacklist; if not, entering a longitudinal scanning checking unit; since the finger scan for one port is not an attack, the first access number threshold is preferably 3;
the longitudinal scanning verification unit is used for classifying the ports into hot ports and cold ports based on the scanning frequency of the ports by the SDN controller, carrying out weighted calculation on the access quantity of the hot ports and the cold ports under the same target address through a weighted formula to obtain weighted access times, judging whether the weighted access times exceed a second access quantity threshold value, if so, indicating that the corresponding flow is a malicious flow scanned by the longitudinal ports, and adding the source address corresponding to the malicious flow into a blacklist; if not, the malicious flow is not existed, and the data message forwarding module is accessed.
The weighting formula is specifically as follows: totalweight=a cps+b OPS;
wherein, totalweight represents the weighted access times; CPS represents a hot port; OPS represents a cold gate port; a and b each represent a weight threshold, a is preferably 5, b is preferably 3; the second access number threshold is preferably 15.
The data message forwarding module is specifically configured to:
when the OpenFlow switch receives a data message, judging whether the data message is a SYN message or not through a PacketIn message, and if so, sending the data message to an SDN controller; if not, discarding the data message, and updating the routing rule of the flow table in the OpenFlow switch based on the discarded data message, thereby preventing ACK/FIN attack and Christmas tree attack.
The flow table updating module is specifically configured to:
the SDN controller analyzes the received data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, if yes, adds a discarding rule aiming at the source address of the data message into a flow table in an OpenFlow switch; if not, adding a forwarding rule aiming at the source address of the data message in a flow table in the OpenFlow switch.
Deleting the flow table items in the flow table through a request of an SDN controller or a set timer so as to prevent overflow of the flow table items; the duration of the timer is preferably 15 seconds.
In summary, the invention has the advantages that:
analyzing the statistical data to obtain a source address, a target address, a port and the number of messages and storing the source address, the target address, the port and the number of messages in a database by acquiring the statistical data of all flows in an SDN network, judging whether the source address, the target address, the port and the number of messages are malicious flows scanned by a transverse port or a longitudinal port or not by an SDN controller, and adding the source address corresponding to the malicious flows into a blacklist of a flow table; when the OpenFlow switch receives the data message, the data message of the non-SYN message is filtered through the PacketIn message and then sent to the SDN controller; the SDN controller analyzes the data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, and further updates a flow table in the OpenFlow switch, namely, adopts a non-invasive method to maliciously check a flow scanned by the port, dynamically updates the flow table of the OpenFlow switch to ensure network safety, is lighter than traditional invasive IDS and IPS, has low network resource consumption, memory occupation and power consumption during data processing, further greatly reduces resource consumption of network intrusion defense, and also avoids extra exchange delay because the message content is not required to be analyzed first and then the message route is performed.
While specific embodiments of the invention have been described above, it will be appreciated by those skilled in the art that the specific embodiments described are illustrative only and not intended to limit the scope of the invention, and that equivalent modifications and variations of the invention in light of the spirit of the invention will be covered by the claims of the present invention.
Claims (10)
1. A network intrusion prevention method aiming at port scanning is characterized in that: the method comprises the following steps:
step S10, an SDN controller acquires statistical data of all flows from a connected OpenFlow switch, analyzes the statistical data to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database;
step S20, the SDN controller performs malicious flow verification based on the source address, the target address, the port and the message quantity, and adds the source address corresponding to the malicious flow into a blacklist;
step S30, when the OpenFlow switch receives a data message, the data message is sent to the SDN controller through a PacketIn message;
and step S40, the SDN controller analyzes the received data message to obtain a source address, a target address and a port, checks the source address, the target address and the port obtained by analysis through the database, and updates a flow table in the OpenFlow switch.
2. The network intrusion prevention method for port scanning according to claim 1, wherein: the step S10 specifically includes:
the SDN controller periodically requests a flow statistic device from the connected OpenFlow switch through an API, further acquires statistic data of all flows, analyzes the statistic data in real time to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database of the SDN controller.
3. The network intrusion prevention method for port scanning according to claim 1, wherein: the step S20 specifically includes:
step S21, the SDN controller sets a message number threshold, a first access number threshold and a second access number threshold, judges whether the message number of each flow is smaller than or equal to the message number threshold, and if yes, enters step S22; if not, the description is not a malicious stream, and the process proceeds to step S30;
step S22, the SDN controller judges whether the number of the same ports accessing different target addresses exceeds a first access number threshold, if so, the corresponding flow is a malicious flow scanned by a transverse port, and the source address corresponding to the malicious flow is added into a blacklist; if not, go to step S23;
step S23, classifying the ports into hot ports and cold ports based on the scanning frequency of the ports by the SDN controller, carrying out weighted calculation on the access quantity of the hot ports and the cold ports under the same target address through a weighted formula to obtain weighted access times, judging whether the weighted access times exceed a second access quantity threshold, if so, explaining that the corresponding flow is a malicious flow scanned by the longitudinal port, and adding the source address corresponding to the malicious flow into a blacklist; if not, it is determined that there is no malicious flow, and the process proceeds to step S30.
4. The network intrusion prevention method for port scanning according to claim 1, wherein: the step S30 specifically includes:
when the OpenFlow switch receives a data message, judging whether the data message is a SYN message or not through a PacketIn message, and if so, sending the data message to an SDN controller; if not, discarding the data message, and updating the routing rule of the flow table in the OpenFlow switch based on the discarded data message.
5. The network intrusion prevention method for port scanning according to claim 1, wherein: the step S40 specifically includes:
the SDN controller analyzes the received data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, if yes, adds a discarding rule aiming at the source address of the data message into a flow table in an OpenFlow switch; if not, adding a forwarding rule aiming at the source address of the data message in a flow table in the OpenFlow switch.
6. A network intrusion prevention system for port scanning, characterized by: the device comprises the following modules:
the statistical data analysis module is used for acquiring statistical data of all flows from the connected OpenFlow switch by the SDN controller, analyzing the statistical data to obtain a source address, a target address, a port and the number of messages and storing the source address, the target address, the port and the number of messages in a database;
the malicious flow verification module is used for carrying out malicious flow verification by the SDN controller based on the source address, the target address, the port and the message quantity, and adding the source address corresponding to the malicious flow into a blacklist;
the data message forwarding module is used for sending the data message to the SDN controller through a PacketIn message when the OpenFlow switch receives the data message;
and the flow table updating module is used for analyzing the received data message by the SDN controller to obtain a source address, a target address and a port, checking the analyzed source address, target address and port through the database, and updating the flow table in the OpenFlow switch.
7. A network intrusion prevention system for port scanning according to claim 6, wherein: the statistical data analysis module is specifically configured to:
the SDN controller periodically requests a flow statistic device from the connected OpenFlow switch through an API, further acquires statistic data of all flows, analyzes the statistic data in real time to obtain a source address, a target address, a port and the number of messages, and stores the source address, the target address, the port and the number of messages in a database of the SDN controller.
8. A network intrusion prevention system for port scanning according to claim 6, wherein: the malicious flow verification module specifically comprises:
the SDN controller is used for setting a message quantity threshold, a first access quantity threshold and a second access quantity threshold, judging whether the message quantity of each flow is smaller than or equal to the message quantity threshold, and entering a transverse scanning verification unit if the message quantity of each flow is smaller than or equal to the message quantity threshold; if not, indicating that the flow is not malicious and entering a data message forwarding module;
the transverse scanning verification unit is used for judging whether the number of the same ports accessing different target addresses exceeds a first access number threshold value or not by the SDN controller, if so, the corresponding flow is a malicious flow scanned by the transverse ports, and the source address corresponding to the malicious flow is added into a blacklist; if not, entering a longitudinal scanning checking unit;
the longitudinal scanning verification unit is used for classifying the ports into hot ports and cold ports based on the scanning frequency of the ports by the SDN controller, carrying out weighted calculation on the access quantity of the hot ports and the cold ports under the same target address through a weighted formula to obtain weighted access times, judging whether the weighted access times exceed a second access quantity threshold value, if so, indicating that the corresponding flow is a malicious flow scanned by the longitudinal ports, and adding the source address corresponding to the malicious flow into a blacklist; if not, the malicious flow is not existed, and the data message forwarding module is accessed.
9. A network intrusion prevention system for port scanning according to claim 6, wherein: the data message forwarding module is specifically configured to:
when the OpenFlow switch receives a data message, judging whether the data message is a SYN message or not through a PacketIn message, and if so, sending the data message to an SDN controller; if not, discarding the data message, and updating the routing rule of the flow table in the OpenFlow switch based on the discarded data message.
10. A network intrusion prevention system for port scanning according to claim 6, wherein: the flow table updating module is specifically configured to:
the SDN controller analyzes the received data message to obtain a source address, a target address and a port, judges whether the database has the matched source address, target address and port, if yes, adds a discarding rule aiming at the source address of the data message into a flow table in an OpenFlow switch; if not, adding a forwarding rule aiming at the source address of the data message in a flow table in the OpenFlow switch.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211639079.3A CN116032582A (en) | 2022-12-20 | 2022-12-20 | Network intrusion prevention method and system for port scanning |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211639079.3A CN116032582A (en) | 2022-12-20 | 2022-12-20 | Network intrusion prevention method and system for port scanning |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116032582A true CN116032582A (en) | 2023-04-28 |
Family
ID=86077056
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211639079.3A Pending CN116032582A (en) | 2022-12-20 | 2022-12-20 | Network intrusion prevention method and system for port scanning |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116032582A (en) |
-
2022
- 2022-12-20 CN CN202211639079.3A patent/CN116032582A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7426634B2 (en) | Method and apparatus for rate based denial of service attack detection and prevention | |
| JP3993092B2 (en) | Methods to prevent denial of service attacks | |
| US8677473B2 (en) | Network intrusion protection | |
| US9049220B2 (en) | Systems and methods for detecting and preventing flooding attacks in a network environment | |
| US8091132B2 (en) | Behavior-based traffic differentiation (BTD) for defending against distributed denial of service (DDoS) attacks | |
| CN101589595B (en) | Pinning mechanism for potentially contaminated end systems | |
| Phan et al. | OpenFlowSIA: An optimized protection scheme for software-defined networks from flooding attacks | |
| US8769681B1 (en) | Methods and system for DMA based distributed denial of service protection | |
| US20180091547A1 (en) | Ddos mitigation black/white listing based on target feedback | |
| US8006303B1 (en) | System, method and program product for intrusion protection of a network | |
| EP1705863A1 (en) | Method and apparatus for traffic control of dynamic denial of service attacks within a communications network | |
| US7854000B2 (en) | Method and system for addressing attacks on a computer connected to a network | |
| JP4774307B2 (en) | Unauthorized access monitoring device and packet relay device | |
| WO2007121361A2 (en) | Malicious attack detection system and an associated method of use | |
| AU2009200102A1 (en) | Method and apparatus for inspecting inter-layer address binding protocols | |
| KR101553264B1 (en) | System and method for preventing network intrusion | |
| US8910267B2 (en) | Method for managing connections in firewalls | |
| US20090240804A1 (en) | Method and apparatus for preventing igmp packet attack | |
| US20070289014A1 (en) | Network security device and method for processing packet data using the same | |
| CN104243408A (en) | Method, device and system for monitoring messages in domain name resolution service DNS system | |
| CN1175621C (en) | A Method for Detecting and Monitoring Malicious User Host Attacks | |
| US12368750B2 (en) | Intelligent manipulation of denial-of-service attack traffic | |
| KR20030009887A (en) | A system and method for intercepting DoS attack | |
| CN116032582A (en) | Network intrusion prevention method and system for port scanning | |
| RU2812087C1 (en) | System and method for analysing incoming traffic flow |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |