IPSec VPN protocol drastic detecting method based on flows

Abstract

The invention relates to a deep detection method of an IPSec VPN protocol based on stream, which is applied in the network safety field. The deep detection method of the invention firstly carries out cyclic monitoring under the promiscuous mode that network card is opened in an intelligent agent or a probe machine, and a BPF filter is arranged to snatch an IPSec VPN message. The deep inspection method can store and carry out deep detection on the sequence stream of IPSec message, can identify and analyze whether the IPSec VPN message is faked and is the message of non-standard format or not, and can analyze the differences between the message of non-standard format and the message of standard format according to the context of the sequence stream of the IPSec VPN message. The deep detection method provided by the invention based on the session state of the protocol has considerable intelligence and stable performance, can analyze the message of unknown format and can be easily realized and applied in the fields such as supervision agency, firewall, IDS, etc.

Description

technical field [0001] The invention relates to a detection method in the technical field of network security, in particular to a flow-based IPSec VPN protocol depth detection method. Background technique [0002] IPSec is an infrastructure security technology. Using IPSec can provide security features not in the original IP protocol: confidentiality, integrity, identity verification, anti-traffic analysis, etc. The IPSec VPN uses the IPSec security protocol to establish a VPN tunnel, which can establish a secure virtual channel on the public network for remote access. There are many international standards for various aspects of IPSec VPN technology. IPSec protocol has (IPSecurity-RFC 2401~2411, 2451) standards; encryption has ESP DES and 3DES (RFC 2406, 2451) standards, and authentication has X.509 digital certificate ( RSA signature), shared key, simple certificate enrollment protocol and other standards; integrity has HMAC-MD5 & HMAC-SHA-1 (RFC 2403-2404) and other sta...

AI Technical Summary

Problems solved by technology

Although this method has advantages in speed and scalability, for non-standard format messages, due to the interference of non-standard headers, the protocol type of the message has become unrecognizable, and the contents of the fields inside are also unrecognizable. Because the non-standard headers are all misplaced, the parsing will cause errors, and the string matching will not be useful

[0006] In further searches, no literature reports on the deep detection method for IPSec VPN have been found

Images