Network attack path reconstruction method based on topological information

Abstract

The invention relates to the technical field of network space security, in particular to a network attack path reconstruction method based on topological information, which comprises the following steps of: firstly, obtaining a network topological structure by utilizing topological measurement probes distributed in each area of a network through a traceroute technology, then extracting router information through which an attack flow passes through through a NetFlow / NetStream technology, and finally reconstructing a network attack path according to the extracted router information, and then, according to the extracted routers and related network topology data, adopting a Dijkstra shortest path selection algorithm to gradually reconstruct an attack path of the whole attack flow. According to the method, active and passive network measurement methods are comprehensively utilized, the path information of the network attack can be accurately and completely drawn, and the correctness of a reconstruction structure is ensured.

Description

technical field [0001] The invention relates to the technical field of network space security, in particular to a network attack path reconstruction method based on topology information. Background technique [0002] With the rapid development of the Internet, more and more traditional operation methods are being replaced by low-consumption, open and efficient distributed network applications, and the network has become an indispensable part of people's daily life. However, network-based attacks have become more and more intense, network security incidents have emerged one after another, and various network attacks have brought serious harm to the country, society and individuals. Attackers take advantage of the rapid and extensive interconnectivity of the network, making traditional security measures basically useless and seriously threatening the security of the country and society. Network security threats have brought huge losses to the country and people's lives. Secur...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is to provide a network attack path reconstruction method based on topology information, which can effectively solve the problem that the network attack path is difficult to reconstruct

Images