A multi-layer protocol network beacon implantation detection method for traceability applications

Abstract

In order to overcome the problems that the existing probabilistic data packet marking technology is difficult to trace the source of a single packet and easily cause compatibility with existing protocols, the present invention proposes a multi-layer protocol network beacon implantation detection method for traceability applications. Introduce network beacon technology, and implant some carefully selected fields in the three-layer protocol of the network layer, transport layer, and application layer of the monitored target traffic to form a concealed, stable, and easy-to-detect Network beacon implantation; carry out targeted detection of network beacons based on the content of specific fields of multi-layer protocols, identify and locate traffic with implanted network beacons, and select or combine the use of network layer, transport layer, and application layer three-layer protocols The network beacon is implanted in the appropriate field in the network, and the attack path is restored through collaborative monitoring and detection, and the traceability based on single-packet beacon discovery can be carried out.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a method for detecting implantation of multi-layer protocol network beacons oriented to traceability applications. Background technique [0002] At present, with the application and development of Internet technology, network attackers pose a serious threat to key business networks such as enterprise networks, telecommunication networks, provincial networks, and international networks, as well as network infrastructure. In order to hide their identities and traffic sources, attackers usually use multi-level springboard forwarding to avoid tracking and tracing, which greatly increases the difficulty for security defenders to track and trace attackers. [0003] Based on massive threat intelligence correlation analysis and traceability technology, there is a problem that threat intelligence cannot be updated in time, resulting in poor traceability effect. In addition, the e...

AI Technical Summary

Problems solved by technology

[0005] In order to overcome the problems that the existing probabilistic data packet marking technology is difficult to trace the source of a single packet and easily cause compatibility with existing protocols, the present invention proposes a multi-layer protocol network beacon implantation detection method for traceability applications. Introduce network beacon technology, and implant some carefully selected fields in the three-layer protocol of the network layer, transport layer, and application layer of the monitored target traffic to form a concealed, stable, and easy-to-detect web beacon implants for

Images