Detection method and device for carrying out covert channel communication based on ICMP protocol

Abstract

The invention provides a detection method and device for covert channel communication based on an ICMP protocol, and relates to the field of communication, and the method comprises the steps: analyzing an obtained ICMP flow message, and obtaining a transmission identification and a transmission content; judging whether the transmission content is messy or not; if the transmission content is messy,judging whether the request content and the response content corresponding to the target transmission identifier are the same or not; and if the request content and the response content correspondingto the target transmission identifier are different, determining a covert channel communication behavior based on the target transmission identifier. Whether the covert channel communication behaviorbased on the ICMP exists or not is recognized based on flow analysis, the performance requirement for detection equipment is lowered, the detection efficiency is improved, meanwhile, use of a networktroubleshooting tool is not affected, and normal operation of a network is facilitated.

Description

technical field [0001] The invention relates to the technical field of communication, in particular to a detection method and device for concealed channel communication based on the ICMP protocol. Background technique [0002] The Internet Control Message Protocol (Internet Control Message Protocol, ICMP) is a sub-protocol of the TCP / IP protocol suite, which is used to transmit control messages between IP hosts and routers. The control message refers to the message of the network itself such as whether the network is unreachable, whether the host is reachable, and whether the route is available. Commonly used commands such as ping and tracert to check whether the network is unreachable are based on the ICMP protocol. [0003] Covert channel communication based on ICMP protocol, as its name implies, is a method of using ICMP protocol for data transmission to achieve communication means. Because ICMP uses a lower-standard communication protocol, the traffic in the network is...

AI Technical Summary

Problems solved by technology

[0004] At present, in the prior art, there are mainly two detection methods for covert channels based on the ICMP protocol: scheme 1, checking the content of the ICMP data packet, judging whether the content of the ICMP data packet conforms to the ICMP protocol specification and requesting comments (Request For Comments, RFC) standard; this scheme 1 has the following disadvantages: the consumption performance is relatively large, the performance requirements of the detection equipment are relatively high, and many normal ICMP communications do not strictly abide by the ICMP protocol specification and RFC standard; scheme 2 completely prohibits the ICMP protocol, In solution 2, because the ICMP protocol is completely prohibited, the commands such as ping and tracert to check whether the network is unreachable are invalid, making it very difficult to check whether the network is unreachable.

Images