Multi-layer protocol network beacon implantation detection method for tracking and tracing application

Abstract

In order to solve the problems that the existing probability-based data packet marking technology is difficult to carry out single packet traceability and is easy to cause compatibility with the existing protocol, the invention provides a multi-layer protocol network beacon implantation detection method for tracking and traceability application, which introduces a network beacon technology. Network beacon construction and implantation are carried out on some carefully selected fields in three-layer protocols of a network layer, a transmission layer and an application layer of monitored target traffic, and network beacon implantation with concealment, stability and detectability is formed; network beacon detection based on multi-layer protocol specific field content is carried out in a targeted manner, flow with implanted network beacons is identified and positioned, proper fields in three-layer protocols of a network layer, a transmission layer and an application layer are selected or used in a combined manner to carry out network beacon implantation, and attack path restoration is carried out in a cooperative monitoring and detection manner; and tracking and tracing based on single-packet beacon discovery can be carried out.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a method for detecting implantation of multi-layer protocol network beacons oriented to traceability applications. Background technique [0002] At present, with the application and development of Internet technology, network attackers pose a serious threat to key business networks such as enterprise networks, telecommunication networks, provincial networks, and international networks, as well as network infrastructure. In order to hide their identities and traffic sources, attackers usually use multi-level springboard forwarding to avoid tracking and tracing, which greatly increases the difficulty for security defenders to track and trace attackers. [0003] Based on massive threat intelligence correlation analysis and traceability technology, there is a problem that threat intelligence cannot be updated in time, resulting in poor traceability effect. In addition, the e...

AI Technical Summary

Problems solved by technology

[0005] In order to overcome the problems that the existing probabilistic data packet marking technology is difficult to trace the source of a single packet and easily cause compatibility with existing protocols, the present invention proposes a multi-layer protocol network beacon implantation detection method for traceability applications. Introduce network beacon technology, and implant some carefully selected fields in the three-layer protocol of the network layer, transport layer, and application layer of the monitored target traffic to form a concealed, stable, and easy-to-detect web beacon implants for

Images