Device and method for identifying attacks in a computer network

Abstract

The present invention relates to an apparatus and a method for identifying attacks in a computer network, wherein a data packet is received at the input of a hardware switching device, wherein an output of the hardware switching device is selected for sending the data packet or a copy of the data packet based on data link layer information from the data packet and based on a hardware address, wherein context information of the data packet is determined, wherein in a comparison an actual value of a field from the data packet is compared with a rated value of a value from the field by a hardware filter, wherein the field includes data link layer data or network layer data, and wherein an interrupt is triggered for a computing device based on the result of the comparison, wherein an analysis is performed by a microprocessor based on the context information of the data packet triggered by the interrupt to identify attack patterns in network traffic in the computer network.

Description

Technical Field

[0001] The invention is based on a method and a device for identifying attacks in a computer network. Background Art

[0002] The task of such "Network Intrusion Detection and Prevention Systems" (NIDPS) is to identify anomalies in the network traffic of distributed computer systems and to react to them. NIDPS are systems that are typically used to detect and prevent attacks on corporate networks (so-called enterprise networks). NIDPS can also be used in automotive networks. Automotive networks are vehicle-internal networks with "Electronic Control Units" (ECU) as network nodes.

[0003] Due to the functional differences between enterprise networks and automotive networks, NIDPS used for enterprise networks cannot be effectively used in automotive networks.

[0004] Therefore, it is desirable to provide a NIDPS for automotive networks. Summary of the invention

[0005] This is achieved by the subject matter of the independent claims. In order to provide a NIDPS for automotive networks, the differences between automotive networks and enterprise networks should be taken into account. These differences can be found in their network structure, network dynamics and network nodes.

[0006] Network structure:

[0007] Enterprise networks typically follow a client-server model in which there are a small number of dedicated server network nodes that provide services to a typically larger number of client network nodes. Automotive networks consist of ECUs that exchange sensor signals and actuator commands.

[0008] Enterprise networks are generally significantly larger and more complex than automotive networks. The overall enterprise network is significantly segmented, i.e. physically or logically separated into different areas and subnets. The ECUs in a typical automotive network (if any) are separated into a small number of subnets via "gateways" or logically separated on the Ethernet layer via so-called "Virtual Local Area Networks" (VLANs).

[0009] Network dynamics:

[0010] Enterprise networks and automotive networks differ in the dynamics used to change and operate the networks.

[0011] In an enterprise network, the connected network nodes change dynamically. For changes in server network nodes, it is possible to adapt the configuration of the security system (e.g., NIDPS). In contrast, for network nodes that are clients, such adaptation is generally not possible. This is because some clients connect to the network from changing locations and are replaced relatively frequently. In addition, it is not possible to accurately predict which applications are executed on the clients.

[0012] ECUs in a car network are rarely replaced (if at all), and are usually replaced with identical copies. Therefore, any changes in the way the network functions are unlikely. In a car network, the network nodes are well known. Likewise, the applications running on each network node are well defined, and details about the network communication can be predefined.

[0013] In enterprise networks, it is also common for nodes from the outside to establish a connection into the enterprise network and form part of the internal data traffic. In automotive networks, all communication nodes of this network responsible for vehicle functions are part of the internal vehicle network. External nodes are only granted access to the internal vehicle network for specific functions and to a limited extent, for example for diagnostics or for mobile end devices.

[0014] In an enterprise network, different users may be able to use the same client. In a car network, there are no users in the ECUs, but only applications that perform their services completely autonomously.

[0015] Network Nodes:

[0016] In terms of resources, the network nodes of an enterprise network are typically many times more resource-intensive (e.g., in terms of memory and performance) than the ECUs of an automotive network.

[0017] In terms of software, network nodes in enterprise networks are mostly equipped with commonly used standard operating systems and standard software, for which security vulnerabilities are known. However, it is generally impossible to stipulate which software is executed on which client system, because in many cases users can install and uninstall software. Therefore, the focus of NIDPS systems in enterprise networks is to identify whether attempts are being made to exploit known security vulnerabilities based on signatures. Network nodes in automotive networks are generally equipped with software developed specifically for this application. Most of the signatures from NIDPS systems for enterprise networks cannot be applied, and there is no larger database of known vulnerabilities specifically for automotive networks.

[0018] Although the basic task of NIDPS, i.e. detecting anomalies in network traffic and reacting to anomalies, is the same for enterprise networks and automotive networks, it is clear from the above points that the basic mode of action of an effective NIDPS for automotive networks must be fundamentally different from that of NIDPS for enterprise networks. NIDPS for automotive networks must exploit known and static network structures and significantly smaller dynamics of network participants in order to be able to effectively detect anomalies with limited resources.

[0019] The method for identifying attacks in a computer network provides for receiving a data packet at an input of a hardware switching device, wherein an output of the hardware switching device is selected for sending the data packet or a copy of the data packet based on data link layer information from the data packet and based on a hardware address, wherein context information of the data packet is determined, wherein in a comparison, an actual value of a field from the data packet is compared with a setpoint value of a value from the field by a hardware filter, wherein the field comprises data link layer data or network layer data, and wherein an interrupt is triggered for a computing device based on the result of the comparison, wherein an analysis is performed by a microprocessor based on the context information of the data packet in order to identify attack patterns in the network traffic in the computer network, triggered by the interrupt. In particular, an interrupt is triggered when there is a deviation between the actual value and the setpoint value. The interrupt can be triggered when the deviation reaches, exceeds or falls below a threshold value.

[0020] Preferably, the context information of the data packet is stored in a register, wherein the microprocessor performs a register access to the register for the analysis. This is a particularly efficient approach in terms of computing resources.

[0021] Preferably, it is provided that when there is a deviation between the actual value and the setpoint value, or when the deviation exceeds a threshold value, the context information of the data packet is stored in the register. Thus, the context information is provided particularly effectively for attack identification when necessary, in particular when there is a deviation.

[0022] Preferably, provision is made that context information of the data packet is determined as a function of the result of the analysis and is stored in a register. Thus, the context information is also updated in the register as a function of the analysis.

[0023] Preferably, it is provided that the hardware filter comprises a ternary content addressable memory in which a mask of the setpoint value is stored, wherein the actual value is compared with the mask stored in the ternary content addressable memory and whether a deviation exists is determined based on the result of the comparison. Thus, a freely configurable check can be implemented.

[0024] Preferably, it is provided that the setpoint value characterizes a hardware address, in particular a media access control address, wherein the actual value is determined from data in a hardware address field of a data packet from an input or output, in particular a media access control address. This makes it possible to detect attacks based on the underlying media access control protocol.

[0025] Preferably, it is provided that the setpoint value characterizes the virtual local area network and that the actual value is determined as a function of data characterizing the properties of the data packets at the input or output for the virtual local area network. This makes it possible to detect attacks based on the underlying virtual local area network.

[0026] Preferably, provision is made that the presence of a deviation is detected when the hardware filter detects an unmarked virtual logical area network data packet for a marked virtual logical area network at the input or output, or when the hardware filter detects a marked virtual logical area network data packet for an unmarked virtual logical area network at the input or output. This enables the detection of attacks based on the marking.

[0027] Preferably, provision is made for the hardware filter to detect the presence of a deviation when it detects a data packet with an unknown Ethernet type, an incorrect checksum, an incorrect packet length or an incorrect packet structure at the input or output. This makes it possible to detect an attack based on the underlying Ethernet type.

[0028] Preferably, provision is made that, if the DHCP filter determines (328) a DHCP packet for Internet Protocol Version 4 and / or Internet Protocol Version 6 with DHCP port 67 and / or port 68 at the input or output,

[0029] When a transmission control protocol or user datagram protocol filter determines (328) a transmission control protocol or user datagram protocol broadcast message for Internet Protocol version 4 and / or Internet Protocol version 6 at the input or output,

[0030] When the Precision Time Protocol filter determines (328) a Precision Time Protocol message at the input or output, wherein the content of the Precision Time Protocol message, in particular the timestamp, the sequence number, the correction field, is at least partially stored in a register for context information,

[0031] Identify the existence of deviations.

[0032] This enables the identification of attacks based on the protocol they are based on.

[0033] The corresponding device is designed as a system on a chip, which includes a hardware switch device, a hardware filter, a register and a computing device for detecting attacks, and the system on a chip is designed to execute the method. As a result, the detection of attacks can be carried out particularly efficiently in an integrated solution.

[0034] Preferably, the hardware switching device is designed to store the context information of the data packet in a register, wherein the microprocessor is designed to perform a register access to the register for the evaluation. This enables direct access.

[0035] Preferably, the hardware switching device is designed to store context information of the data packet in a register when there is a deviation between the actual value and the setpoint value or when the deviation exceeds a threshold value. Direct access to the context information memory is advantageous in particular with regard to the functional efficiency of the hardware switching device.

[0036] Preferably, the microprocessor is designed to determine context information of the data packet as a function of the result of the analysis and to store it in a register. Direct access to the context information memory is advantageous in particular with regard to the efficiency of detecting attacks.

[0037] Preferably, the ternary content addressable memory (108), the address translation unit, the virtual local area network translation unit, the dynamic host configuration protocol filter, the transmission control protocol or user datagram protocol filter and / or the precision time protocol filter are configured as hardware filters, which analyze the data packets to identify attacks and provide an interrupt to a microprocessor for identifying attacks based on the inspection results. In this regard, this can realize a particularly advantageous method. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Further advantageous embodiments are apparent from the following description and the accompanying drawings.

[0039] Figure 1 A schematic diagram showing a device for identifying an attack,

[0040] Figure 2 shows the data flow in the device,

[0041] Figure 3 Steps in a method for identifying an attack are shown. DETAILED DESCRIPTION

[0042] Figure 1 A schematic diagram of a device 100 for detecting attacks in a computer network is shown. The device 100 is designed as a system on a chip.

[0043] The device 100 includes a hardware switch device 102, a hardware filter 104, and a computing device 106 for identifying attacks. The computing device 106 is described below by taking a microprocessor as an example. Instead of a microprocessor, a microcontroller may also be used.

[0044] In this example, the computer network is an automotive Ethernet network. The exemplary described automotive Ethernet is based on the Ethernet standard IEEE 802.3-2018 and may include elements from IEEE 802.1Q, 100BASE-T1 or 1000BASE-T1. BroadR-Reach or 100BASE-T1 / X specifies the physical transmission medium in layer 1. In the Ethernet protocol stack, there are other standards that are partly specific to the automotive context, such as DoIP, SOME / IP and partly IPv4, TSN.

[0045] In the context of Automotive Ethernet, sometimes only parts of one standard are used and not others, ie not even the entire protocol range.

[0046] In this example, the hardware switch device 102 comprises an Ethernet switch.

[0047] In this example, the hardware filter 104 includes a ternary content addressable memory 108, an address translation unit 110, a virtual local area network translation unit 112, and other hardware filters 114, such as a dynamic host configuration protocol filter, a transmission control protocol or user datagram protocol filter, and / or a precision time protocol filter.

[0048] The hardware filter 104 is configured to analyze the data packet to identify an attack. The hardware filter 104 is optionally configured to provide the data packet or a copy of the data packet to the microprocessor 106 for identifying an attack based on the inspection result. To this end, the hardware filter 104 and the microprocessor 106 are optionally connected to a data conductor 116. In this example, the microprocessor 106 is part of a microcontroller, which includes a random access memory 118. The data packet can be transmitted from the hardware filter 102 via the data conductor 116 to the random access memory 118 to identify an attack.

[0049] The device 100 comprises at least one input and at least one output. These inputs and outputs are implemented as ports 120 for the hardware switch means 102.

[0050] The hardware switch device 102 includes a register 122 for context information about the data packet.

[0051] The hardware switch device 102 includes a memory for storing the hardware address of the following device of the computer network, which is coupled to the device 100. In this example, the memory includes a register 122 for context information. On the one hand, the memory is a random access memory. The memory can also be configured as a non-volatile read-write memory, which can permanently store the context information.

[0052] The hardware switch device 102 is configured to receive a data packet at an input and to select an output of the device 100 for transmitting the data packet or a copy of the data packet based on data link layer information from the data packet and based on a hardware address from a memory.

[0053] The microprocessor 106 is configured to perform analysis based on the context information from the register 122 to identify attack patterns in network traffic in the computer network. The microprocessor 106 is configured to read the context information in the register 122 and determine the context information of the register 122 based on the result of the analysis, and write the final context information into the register 122. The microprocessor 106 is configured to receive an interrupt from the hardware switch device 102. The microprocessor 106 is configured to perform analysis when receiving the interrupt.

[0054] The hardware filter 104 is configured to compare an actual value of a field from the data packet with a nominal value of a value from the field in the comparison. The field includes data link layer data or network layer data. The hardware filter 104 is configured to send an interrupt to the microprocessor 106 according to the result of the comparison if there is a deviation between the actual value and the nominal value or the deviation exceeds a threshold.

[0055] The representation of the hardware filter 104 is described below.

[0056] For example, the hardware filter 104 includes a ternary content addressable memory 108 in which a mask of a nominal value is stored. In this case, the hardware filter 104 is configured to compare the actual value with the mask stored in the ternary content addressable memory and determine whether there is a deviation based on the result of the comparison.

[0057] For example, the rated value represents a hardware address from the memory. The hardware address is in particular a media access control address of the data link layer. In this example, the hardware filter 104 includes an address conversion unit 110, which is configured to determine the actual value based on data in a hardware address field of a data packet at an input or output of the device 100, compare the actual value with the rated value in a comparison, and determine whether there is a deviation based on the result of the comparison.

[0058] The address translation unit 110 is a unit in the data link layer which selects the output in the hardware switching device 102 for transmitting a received data packet or a copy of the data packet during operation.

[0059] For example, the rated value characterizes a virtual local area network. The rated value is stored, for example, in a memory. The hardware filter 104 comprises a virtual local area network conversion unit 112, which is configured to determine the actual value based on the following data, the data characterizing the attributes of the data packet at the input or output of the device 100 to the virtual local area network, compare the actual value with the rated value in the comparison, and determine whether there is a deviation based on the result of the comparison.

[0060] The VLAN switching unit 112 is a unit in the data link layer which selects the output in the hardware switch device 102 to which a received data packet or a copy of the data packet is transmitted during operation in the VLAN.

[0061] The hardware filter 104 may be configured to recognize the presence of a deviation if the hardware filter 104 determines an untagged virtual logical area network data packet for a tagged virtual logical area network at an input or output of the device, or if another hardware filter 114 determines a tagged virtual logical area network data packet for an untagged virtual logical area network at an input or output of the device.

[0062] Hardware filter 104 may be designed to detect the presence of a deviation if other hardware filters 114 detect data packets with an unknown Ethernet type, with an incorrect checksum or an incorrect packet structure at an input or output of device 100 .

[0063] The hardware filter 104 may include a dynamic host configuration protocol filter as a further hardware filter 114, which is constructed to determine dynamic host configuration protocol packets for Internet Protocol version 4 and / or Internet Protocol version 6 with dynamic host configuration protocol port 67 and / or port 68 at the input or output of the device.

[0064] The hardware filter 104 may include a Transmission Control Protocol or User Datagram Protocol filter as a further hardware filter 114, which is constructed to determine Transmission Control Protocol or User Datagram Protocol broadcast messages for Internet Protocol version 4 and / or for Internet Protocol version 6 at the input or output of the device.

[0065] The hardware filter 104 may include a precision time protocol filter as a further hardware filter 114, which is constructed to determine a precision time protocol message at an input or output of the device and to store the content of the precision time protocol message, in particular a timestamp, a sequence number, a correction field, at least partially in a register for context information.

[0066] The described representations of the hardware filter 104 can be arranged in parallel or in sequence in the hardware switching device 102. It is not necessary to provide all representations of the hardware filter 104.

[0067] The hardware filter 104 is configured to, when there is a deviation, send an interrupt for triggering an analysis of the data packets whose actual values ​​have been compared to the microprocessor 106. In one aspect, the hardware filter 104 is configured to, when there is no deviation, not send an interrupt to the microprocessor 106. In another aspect, the hardware filter 104 is configured to compare the deviation with a threshold value and, when the deviation exceeds the threshold value, send an interrupt to the microprocessor 106 for analyzing the data packets whose actual values ​​have been compared.

[0068] Figure 2 An exemplary data flow in device 100 is shown for Ethernet data packet 200. Ethernet data packet 200 is received at an input of device 100 (i.e., one of ports 120 in this example). Ethernet data packet 200 is transmitted at an output of device 100 (i.e., one of ports 120 in this example).

[0069] Between the input and the output, the Ethernet data packet 200 passes through a first hardware filter 114a which is designed to check the packet structure. The first hardware filter 114a is designed to send an interrupt to the microprocessor 106 if the packet structure does not correspond to the nominal structure of the Ethernet data packet 200, otherwise no interrupt is sent. The first hardware filter 114a is optionally designed to transfer the Ethernet data packet 200 to the random access memory 118 via the data line 116 for the microprocessor 106 if the packet structure does not correspond to the nominal structure of the Ethernet data packet 200, otherwise the Ethernet data packet 200 is not transferred.

[0070] Between the first hardware filter 114a and the output, the Ethernet data packet 200 passes through a second hardware filter 114b, which is designed to check the checksum of the Ethernet data packet 200. The second hardware filter 114a is designed to send an interrupt to the microprocessor 106 if the checksum does not correspond to the nominal checksum of the Ethernet data packet 200, otherwise no interrupt is sent. The second hardware filter 114a is optionally designed to transfer the Ethernet data packet 200 to the random access memory 118 via the data line 116 for the microprocessor 106 if the checksum does not correspond to the nominal checksum of the Ethernet data packet 200, otherwise the Ethernet data packet 200 is not transferred.

[0071] Between the second hardware filter 114 b and the output, the Ethernet data packet 200 passes through the address translation unit 110. The address translation unit 110 is designed to send an interrupt to the microprocessor 106 if a deviation is detected, otherwise no interrupt is sent. The address translation unit 110 is optionally designed to transfer the Ethernet data packet 200 to the random access memory 118 via the data line 116 for the microprocessor 106 if a deviation is detected, otherwise the Ethernet data packet 200 is not transferred. In addition, in this example, the address translation unit 110 also provides a port 120 for the output.

[0072] Between the address conversion unit 110 and the output, the Ethernet data packet 200 passes through the virtual local area network conversion unit 112. The virtual local area network conversion unit 112 is designed to send an interrupt to the microprocessor 106 if a deviation is detected, otherwise no interrupt is sent. The virtual local area network conversion unit 112 is optionally designed to transfer the Ethernet data packet 200 to the random access memory 118 via the data line 116 for the microprocessor 106 if a deviation is detected, otherwise the Ethernet data packet 200 is not transferred. In addition, in this example, the virtual local area network conversion unit 112 also specifies whether it is permitted to send the Ethernet data packet 200 via the port 120 specified as the output according to the rules of the virtual local area network.

[0073] For example, if port 120 is not allowed to be used for the virtual LAN, the transmission is prohibited.

[0074] In this example, between the virtual local area network switching unit 112 and the output, the Ethernet data packet 200 passes through a further hardware filter 114. The further hardware filter 114 is designed to send an interrupt to the microprocessor 106 if a deviation is detected, otherwise not to send an interrupt. If a deviation is detected, the Ethernet data packet 200 is optionally transferred to the random access memory 118 via the data line 116 for the microprocessor 106. Otherwise, the Ethernet data packet 200 is not transferred.

[0075] exist Figure 2 Also shown is a first interface 202 between the register 122 and the microprocessor 106 , more precisely a processor core 204 of the microprocessor 106 .

[0076] exist Figure 2 1 and 2 , a second interface 206 is also shown between a first interrupt controller 208 of the hardware switching device 102 and a second interrupt controller 210 in the microprocessor 106. The hardware filter 104 is connected to the first interrupt controller 208 via an interrupt data line 212. The hardware filter 104 is designed to send an interrupt to the first interrupt controller 208 via the interrupt data line 212 if a deviation is determined in the hardware filter 104. For example, the interrupt is triggered by the first hardware filter 114a, the second hardware filter 114b, the ternary content addressable memory 108, the address translation unit 110, the virtual local area network translation unit 112, the dynamic host configuration protocol filter, the transmission control protocol or user datagram protocol filter, the precision time protocol filter and / or other hardware filters 114.

[0077] The register 122 is connected to the hardware filter 104 via an interface 214 for context information. The context information is determined by, for example, the first hardware filter 114 a, the second hardware filter 114 b, the ternary content addressable memory 108, the address translation unit 110, the virtual local area network translation unit 112, the dynamic host configuration protocol filter, the transmission control protocol or user datagram protocol filter, the precision time protocol filter and / or other hardware filters 114 according to the Ethernet data packet 200 and stored in the register 122 via the interface 214.

[0078] First interrupt controller 208 is configured to send an interrupt to second interrupt controller 210 via second interface 206 . Second interrupt controller 210 is configured to control processor core 204 to read context information from register 122 when second interrupt controller 210 receives an interrupt.

[0079] The microprocessor 106 is configured to perform analysis based on the context information to identify attack patterns in network traffic in the computer network if an interrupt is received. The microprocessor 106 reads the context information via the first interface 202. The changed context information is written by the microprocessor 106 to the register 122 via the first interface 202.

[0080] The flow described here is an exemplary flow. For the functions, for example, it makes no difference whether it first passes through the other hardware filter 114 and then through the address translation unit 110 or first passes through the address translation unit 110 and then through the other hardware filter 114. This applies to all other components mentioned in the flow shown.

[0081] The ternary content addressable memory 108 may be configured to inspect the payload, ie, to inspect content beyond layer 2 and layer 3. The payload may also be filtered in this aspect.

[0082] Figure 3 Steps in a method for identifying an attack are shown.

[0083] In step 302, Ethernet data packet 200 is received at port 120. Step 304 is then performed.

[0084] In step 304, the packet structure or packet length of the Ethernet data packet 200 is determined. Then step 306 is executed.

[0085] In step 306, it is checked whether the grouping structure deviates from the nominal structure or whether the grouping length deviates from the nominal length. For example, it is checked whether there are irregularities in the grouping structure.

[0086] If there is a deviation from the nominal configuration, step 308 is performed. If there is no deviation, step 310 is performed.

[0087] In step 308, the interrupt and optionally the Ethernet data packet 200 are sent to the microprocessor 106. Step 310 is then executed.

[0088] In step 310, a checksum of the Ethernet data packet 200 is determined. Step 312 is then performed.

[0089] In step 312, the checksum is checked for deviations from a nominal checksum, for example, to check for irregularities in the checksum.

[0090] If there is a deviation from the nominal checksum, then step 314 is performed. If there is no deviation, then step 316 is performed.

[0091] In step 314, the interrupt and optionally the Ethernet data packet 200 are sent to the microprocessor 106. Step 316 is then executed.

[0092] In step 316, the actual hardware address of the Ethernet data packet 200 is determined. Step 318 is then performed.

[0093] In step 318, it is checked whether the actual hardware address is known, in particular whether it is consistent with the hardware address from the memory. For example, it is checked whether there is a known media access control address.

[0094] If there is a deviation, in particular from each known hardware address from the memory, step 320 is performed. If there is no such deviation, in particular if the actual hardware address is known, step 322 is performed.

[0095] In step 320, the interrupt and optionally the Ethernet data packet 200 are sent to the microprocessor 106. Step 322 is then executed.

[0096] In step 322, the actual value characterizing the virtual local area network is determined. Then step 324 is executed.

[0097] In step 324, it is checked whether the actual value corresponds to a desired value that characterizes a virtual local area network into which Ethernet data packets 200 can be sent at the port 120 determined by means of the actual hardware address. In particular, a check is made for consistency with the desired value from a memory.

[0098] If there is a deviation between the actual value and the setpoint value, step 326 is executed. If there is no such deviation, step 328 is executed.

[0099] In step 326, the interrupt and optionally the Ethernet data packet 200 are sent to the microprocessor 106. Step 328 is then executed.

[0100] In step 328, other actual values ​​are optionally determined for analysis using one of the other hardware filters described.

[0101] For example, an untagged virtual logical area network Ethernet data packet 200 is determined for a tagged virtual logical area network at an input end or an output end, or a tagged virtual logical area network Ethernet data packet 200 is determined for an untagged virtual logical area network.

[0102] For example, a dynamic host configuration protocol packet for Internet Protocol version 4 and / or Internet Protocol version 6 with dynamic host configuration protocol port 67 and / or port 68 is determined at the input or output. For example, a user datagram protocol broadcast message for Internet Protocol version 4 and / or for Internet Protocol version 6 is determined at the input or output. For example, a precision time protocol message is determined at the input or output, wherein the content of the precision time protocol message, in particular a timestamp, a sequence number, a correction field, is at least partially stored in a register for context information.

[0103] Then execute step 330.

[0104] In step 330 , it is checked whether the other actual value deviates from the other setpoint value of the other actual value. If there is a deviation, step 332 is executed. Otherwise, step 334 is executed.

[0105] In step 332, the interrupt and optionally the Ethernet data packet 200 are sent to the microprocessor 106. Step 334 is then executed.

[0106] In step 334, the configured actual value of the Ethernet data packet 200 is compared with the mask configured therefor and stored in the ternary content addressable memory. Then step 336 is executed.

[0107] In step 336, it is determined whether there is a deviation from the mask according to the result of the comparison. If there is a deviation, step 338 is performed. If there is no deviation, step 340 is performed.

[0108] In step 338, the interrupt and optionally the Ethernet data packet 200 are sent to the microprocessor 106. Step 340 is then executed.

[0109] In step 340, the Ethernet data packet 200 is sent at the output.

[0110] If the microprocessor 106 receives an interrupt, step 350 is executed.

[0111] In step 350, context information is read from the register.

[0112] Then execute step 352.

[0113] In step 352, context information from register 122 is analyzed to identify attack patterns in network traffic in the computer network. For example, stateless intrusion detection is performed based on the context information. It can be provided that interrupts that occur in the course of time are analyzed. Then step 354 is performed.

[0114] In step 354, the analysis result of the stateless intrusion detection is stored, for example, context information is stored, and then step 356 is executed.

[0115] In step 356, stateful intrusion detection is performed based on information about the stored analysis results, such as analyzing context data in the time process, and then the method ends.

[0116] The context information may also be changed, for example, depending on the results of the analysis, stateless intrusion detection or stateful intrusion detection. The context information is determined in an additional step and stored in the register 122 .

Claims

1. A method for identifying attacks in a computer network, characterized in that A data packet is received at an input of a hardware switch device, wherein an output of the hardware switch device is selected for sending the data packet or a copy of the data packet based on data link layer information from the data packet and based on a hardware address, wherein context information of the data packet is determined, wherein in a comparison an actual value from a field of the data packet is compared with a rated value of a value from the field by a hardware filter, wherein the field comprises data link layer data or network layer data, and wherein if there is a deviation between the actual value and the rated value, an interrupt is triggered for a computing device based on a result of the comparison, wherein via the interrupt triggering, an analysis is performed by a microprocessor based on the context information of the data packet to identify attack patterns in network traffic in the computer network. 2 . The method according to claim 1 , wherein if the deviation exceeds a threshold value, an interruption to the computing device is triggered depending on the result of the comparison.

3. The method according to claim 1, characterized in that The context information of the data packet is stored in a register, wherein the microprocessor performs a register access to the register for the analysis.

4. The method according to claim 3, characterized in that If there is a deviation between the actual value and the desired value, the context information of the data packet is stored in the register. The method of claim 4 , wherein if the deviation exceeds a threshold, storing context information of the data packet in the register.

6. The method according to claim 3, characterized in that Context information of the data packet is determined based on a result of the analysis and the context information is stored in the register.

7. The method according to any one of claims 1 to 6, characterized in that The hardware filter comprises a ternary content addressable memory in which a mask of the rated value is stored, wherein the actual value is compared with the mask stored in the ternary content addressable memory, and whether there is a deviation is determined according to a result of the comparison.

8. The method according to any one of claims 1 to 6, characterized in that The setpoint value characterizes a hardware address, wherein the actual value is determined as a function of data from a hardware address field of a data packet at the input or output.

9. The method according to claim 8, characterized in that The hardware address is a media access control address.

10. The method according to any one of claims 1 to 6, characterized in that The setpoint value characterizes the virtual local area network, and the actual value is determined as a function of data characterizing the properties of the data packets at the input or output for the virtual local area network.

11. The method according to any one of claims 1 to 6, characterized in that The presence of a deviation is identified when the hardware filter determines an untagged virtual logical area network data packet for a tagged virtual logical area network at the input or output, or when the hardware filter determines a tagged virtual logical area network data packet for an untagged virtual logical area network at the input or output.

12. The method according to any one of claims 1 to 6, characterized in that The presence of a deviation is detected if the hardware filter detects at the input or output a data packet with an unknown Ethernet type, with an incorrect checksum, an incorrect packet length or an incorrect packet structure.

13. The method according to any one of claims 1 to 6, characterized in that When the DHCP filter determines at the input or output a DHCP packet for Internet Protocol version 4 and / or Internet Protocol version 6 with DHCP port 67 and / or port 68, or when a transmission control protocol filter or a user datagram protocol filter determines at the input or output a transmission control protocol or user datagram protocol broadcast message for internet protocol version 4 and / or internet protocol version 6, or when a precision time protocol filter determines at the input or output a precision time protocol message, wherein the content of the precision time protocol message is at least partially stored in the register for context information, Identify the existence of deviations.

14. The method according to claim 13, characterized in that The content includes at least one of a timestamp, a sequence number, and a correction field.

15. A device for identifying attacks in a computer network, characterized in that The device is configured as a system on chip, which includes a hardware switch device, a hardware filter, a register, and a computing device for identifying an attack, and the system on chip is configured to execute the method according to any one of claims 1 to 14.

16. The device according to claim 15, characterized in that The hardware switching device is designed to store the context information of the data packet in the register, wherein the microprocessor is designed to perform a register access to the register for evaluation.

17. The device according to claim 15 or 16, characterized in that The hardware switching device is designed to store context information of the data packet in the register if there is a deviation between the actual value and the setpoint value.

18. The apparatus of claim 17, wherein the hardware switch device is configured to store the context information of the data packet in the register if the deviation exceeds a threshold value.

19. The device according to claim 15 or 16, characterized in that The microprocessor is designed to determine context information of the data packet as a function of a result of the analysis and to store the context information in the register.

20. The device according to claim 15 or 16, characterized in that The ternary content addressable memory, the address translation unit, the virtual local area network translation unit, the dynamic host configuration protocol filter, the transmission control protocol filter or the user datagram protocol filter and / or the precision time protocol filter are constructed as hardware filters, which analyze data packets to identify attacks and if there is a deviation between the actual value and the rated value, an interrupt is provided to a microprocessor for identifying attacks based on the inspection result.

21. The apparatus of claim 20, wherein if the deviation exceeds a threshold, an interrupt is provided to a microprocessor for identifying an attack according to a check result.

22. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises computer-readable instructions, which, when executed by a computer, perform the method according to any one of claims 1 to 14.

23. A computer program product, characterized in that The computer program product comprises computer readable instructions which, when executed by a computer, perform the method according to any one of claims 1 to 14 .

Images