Network malicious behavior detection method and switching system using the same

Abstract

A network malicious behavior detection method and a switching system using the same, the method filters malicious packets in a passive manner without responding to packets, the method comprising: checking whether each network packet contains a protocol sub-packet in a predetermined protocol sub-packet set, if the judgment result is yes, marking each network packet corresponding to the judgment result as a suspicious network packet, if the judgment result is no, driving a path control module to allow each network packet corresponding to the judgment result to be transmitted to a target device; and performing a malicious behavior judgment procedure on at least one of the suspicious network packets, if the judgment result is yes, driving the path control module to prohibit at least one of the suspicious network packets corresponding to the judgment result from being transmitted to the target device, if the judgment result is no, driving the path control module to allow at least one of the suspicious network packets corresponding to the judgment result to be transmitted to the target device.

Description

Technical Field

[0001] The present invention relates to a method for ensuring network security, and in particular to a method for detecting network malicious behavior without affecting normal packet transmission speed. Background Art

[0002] In order to maintain the confidentiality, integrity and availability of network systems, it is a common practice to monitor network packets on a network switch to detect malicious or attack behaviors.

[0003] However, in today's high-speed network transmission environment, it is difficult to monitor the entire content of network packets.

[0004] To ensure network security, WO2015027523A1 proposes a method and device for determining TCP port scanning. The patent detects a port scan behavior by actively responding to network packets.

[0005] In addition, TWI436631B proposes a method and device for detecting a port scan with a fake source address. The patent actively responds to network packets to find out the real network source address that initiates the port scan.

[0006] In addition, US8621060B2 proposes “System and method for network vulnerability detection and reporting”. This patent detects security vulnerabilities of networked devices by actively sending network packets.

[0007] However, since the above-mentioned patents all require active response to network packets, their information processing resources are still at risk of being occupied by malicious devices.

[0008] In order to solve the above-mentioned problems, a novel network malicious behavior detection method is urgently needed in the art. Summary of the invention

[0009] 1. An object of the present invention is to disclose a network malicious behavior detection method, which can provide a firewall effect with almost zero impact on network traffic and network speed through a two-stage filtering process.

[0010] 2. Another object of the present invention is to disclose a network malicious behavior detection method, which filters malicious packets in a passive manner without responding to packets, thereby less likely to affect the transmission speed of normal network packets than the existing active method that requires responding to packets.

[0011] To achieve the above-mentioned purpose, a network malicious behavior detection method is proposed, which is implemented by a switching system. The switching system has a path control module, a packet feature acquisition module, a mirror processing module, a feature inspection module and a packet behavior analysis module, and the method includes:

[0012] Utilizing the packet feature acquisition module to acquire data of the network layer and / or the transport layer and / or the data link layer in each network packet to generate a feature data segment respectively;

[0013] Using the packet feature inspection module to inspect whether each of the feature data segments contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, driving the mirror processing module to generate a mirror packet according to the network packet corresponding to the determination result, if the determination result is no, driving the path control module to transmit the network packet corresponding to the determination result to a target device; and

[0014] The packet behavior analysis module is used to perform a malicious behavior judgment procedure on at least one of the mirror packets. If the judgment result is yes, the path control module is driven to prohibit at least one of the network packets corresponding to the judgment result from being transmitted to the target device. If the judgment result is no, the path control module is driven to allow at least one of the network packets corresponding to the judgment result to be transmitted to the target device.

[0015] In one embodiment, the predetermined protocol sub-packet set includes an ARP sub-packet, an ICMP sub-packet, a TCP sub-packet with a SYN value of 1, and a UDP sub-packet with a port number of 53 of the target network address.

[0016] In a possible embodiment, the malicious behavior may be the appearance of multiple mirror packets with the same source address but different target addresses within a predetermined time, the appearance of multiple mirror packets with the same source address, the same target address but different port addresses within a predetermined time, the source address of the mirror packet is in a blacklist, or the source address of the mirror packet is not in a whitelist.

[0017] In one embodiment, the network malicious behavior detection method further includes: using a traffic detection module to put all the network packets into the packet behavior analysis module to perform the malicious behavior judgment procedure when the traffic of the network packets is lower than a threshold.

[0018] In one embodiment, the network malicious behavior detection method further includes: using the packet feature acquisition module to execute a traffic detection program to obtain a traffic value of the network packet, and when the traffic value is lower than a threshold, each of the network packets is processed by the mirror processing module to generate a mirror packet.

[0019] In one embodiment, the network malicious behavior detection method further includes: using the packet feature inspection module to execute a traffic detection program to obtain a traffic value of the characteristic data segment, and when the traffic value is lower than a threshold, each network packet is processed by the mirror processing module to generate a mirror packet.

[0020] To achieve the above object, the present invention further proposes a switching system, which is arranged on a network and has a path control module, a packet feature acquisition module, a mirror processing module, a packet feature inspection module and a packet behavior analysis module to perform a network malicious behavior detection method, the method comprising:

[0021] Utilizing the packet feature acquisition module to acquire data of the network layer and / or the transport layer and / or the data link layer in each network packet to generate a feature data segment respectively;

[0022] Using the packet feature inspection module to inspect whether each of the feature data segments contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, driving the mirror processing module to generate a mirror packet according to the network packet corresponding to the determination result, if the determination result is no, driving the path control module to transmit the network packet corresponding to the determination result to a target device; and

[0023] The packet behavior analysis module is used to perform a malicious behavior judgment procedure on at least one of the mirror packets. If the judgment result is yes, the path control module is driven to prohibit at least one of the network packets corresponding to the judgment result from being transmitted to the target device. If the judgment result is no, the path control module is driven to allow at least one of the network packets corresponding to the judgment result to be transmitted to the target device.

[0024] In one embodiment, the path control module, the packet feature acquisition module and the mirror processing module are implemented in a switch.

[0025] In one embodiment, the packet feature inspection module and the packet behavior analysis module are implemented in the same information processing device or in different information processing devices.

[0026] In one embodiment, the predetermined protocol sub-packet set includes an ARP sub-packet, an ICMP sub-packet, a TCP sub-packet with a SYN value of 1, and a UDP sub-packet with a port number of 53 of the target network address.

[0027] In one embodiment, the malicious behavior may be the appearance of multiple mirror packets with the same source address but different target addresses within a predetermined time, the appearance of multiple mirror packets with the same source address, the same target address but different port addresses within a predetermined time, the source address of the mirror packet is in a blacklist, or the source address of the mirror packet is not in a whitelist.

[0028] In one embodiment, the blacklist includes a network address or a domain name of a command and control server associated with a malware.

[0029] In a possible embodiment, the network malicious behavior detection method may further include: using a traffic detection module to put all the network packets into the packet behavior analysis module to perform the malicious behavior judgment program when the traffic of the network packets is lower than a threshold; or using the packet feature acquisition module to execute a traffic detection program to obtain a traffic value of the network packets, and when the traffic value is lower than a threshold, each of the network packets is processed by the mirror processing module to generate a mirror packet; or using the packet feature inspection module to execute a traffic detection program to obtain a traffic value of the characteristic data segment, and when the traffic value is lower than a threshold, each of the network packets is processed by the mirror processing module to generate a mirror packet.

[0030] In one embodiment, the network is a local area network.

[0031] To achieve the above object, the present invention further proposes a network malicious behavior detection method, which is implemented by a switching system, the switching system having a path control module, a packet feature inspection module and a packet behavior analysis module, the method comprising:

[0032] Using the packet feature inspection module to inspect whether each network packet contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, marking each network packet corresponding to the determination result as a suspicious network packet, if the determination result is no, driving the path control module to transmit each network packet corresponding to the determination result to a target device; and

[0033] The packet behavior analysis module is used to perform a malicious behavior judgment procedure on at least one of the suspicious network packets. If the judgment result is yes, the path control module is driven to prohibit at least one of the suspicious network packets corresponding to the judgment result from being transmitted to the target device. If the judgment result is no, the path control module is driven to allow at least one of the suspicious network packets corresponding to the judgment result to be transmitted to the target device.

[0034] In one embodiment, the predetermined protocol sub-packet set includes an ARP sub-packet, an ICMP sub-packet, a TCP sub-packet with a SYN value of 1, and a UDP sub-packet with a port number of 53 of the target network address.

[0035] In a possible embodiment, the malicious behavior may be the appearance of multiple mirror packets with the same source address but different target addresses within a predetermined time, the appearance of multiple mirror packets with the same source address, the same target address but different port addresses within a predetermined time, the source address of the mirror packet is in a blacklist, or the source address of the mirror packet is not in a whitelist.

[0036] In a possible embodiment, the network malicious behavior detection method may further include: using a traffic detection module to put all the network packets into the packet behavior analysis module to perform the malicious behavior judgment procedure when the traffic of the network packets is lower than a threshold; or using the packet feature inspection module to execute a traffic detection procedure to obtain a traffic value of the network packets, and when the traffic value is lower than a threshold, all the network packets are put into the packet behavior analysis module to perform the malicious behavior judgment procedure.

[0037] To achieve the above object, the present invention further proposes a switching system, which is arranged on a network and has a path control module, a packet feature inspection module and a packet behavior analysis module to perform a network malicious behavior detection method, the method comprising:

[0038] Using the packet feature inspection module to inspect whether each network packet contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, marking each network packet corresponding to the determination result as a suspicious network packet, if the determination result is no, driving the path control module to transmit each network packet corresponding to the determination result to a target device; and

[0039] The packet behavior analysis module is used to perform a malicious behavior judgment procedure on at least one of the suspicious network packets. If the judgment result is yes, the path control module is driven to prohibit at least one of the suspicious network packets corresponding to the judgment result from being transmitted to the target device. If the judgment result is no, the path control module is driven to allow at least one of the suspicious network packets corresponding to the judgment result to be transmitted to the target device.

[0040] In one embodiment, the predetermined protocol sub-packet set includes an ARP sub-packet, an ICMP sub-packet, a TCP sub-packet with a SYN value of 1, and a UDP sub-packet with a port number of 53 of the target network address.

[0041] In a possible embodiment, the malicious behavior may be a feature selected from a group consisting of the following: a plurality of mirror packets having the same source address but different target addresses appear within a predetermined time; a plurality of mirror packets having the same source address, the same target address but different port addresses appear within a predetermined time; the source address of the mirror packet is in a blacklist; or the source address of the mirror packet is not in a whitelist.

[0042] In one embodiment, the blacklist includes a network address or a domain name of a command and control server associated with a malware.

[0043] In a possible embodiment, the network malicious behavior detection method may further include: using a traffic detection module to put all the network packets into the packet behavior analysis module to perform the malicious behavior judgment procedure when the traffic of the network packets is lower than a threshold; or using the packet feature inspection module to execute a traffic detection procedure to obtain a traffic value of the network packets, and when the traffic value is lower than a threshold, all the network packets are put into the packet behavior analysis module to perform the malicious behavior judgment procedure.

[0044] In order to further understand the structure, features and purposes of the present invention, attached drawings and detailed descriptions of preferred specific embodiments are as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A block diagram showing an embodiment of a switching system of the present invention.

[0046] Figure 2 The present invention is a flowchart of an embodiment of a method for detecting malicious network behavior.

[0047] Figure 3 for Figure 1 A schematic diagram of an application example of a switching system.

[0048] Figure 4a for Figure 1 Schematic diagram of a switching system 100 processing normal network communications between information processing devices.

[0049] Figure 4b for Figure 1 Schematic diagram of the switching system 100 processing the attack behavior of a malicious device on a normal information processing device.

[0050] Figure 5 The flowchart is another embodiment of the network malicious behavior detection method of the present invention.

[0051] Figure 6FIG. 4 is a block diagram of another embodiment of a switching system of the present invention.

[0052] [List of Reference Numerals]

[0053] 100: Exchange system

[0054] 110: Path control module

[0055] 120: Packet feature acquisition module

[0056] 130: Image processing module

[0057] 140: Packet feature inspection module

[0058] 150: Packet behavior analysis module

[0059] 200a: Information processing device

[0060] 200b: Information processing device

[0061] 200c: Malicious device

[0062] 300: Exchange system

[0063] 310: Path control module

[0064] 320: Packet feature inspection module

[0065] 330: Packet behavior analysis module

[0066] Step a1: Setting a path control module, a packet feature acquisition module, a mirror processing module, a feature inspection module and a packet behavior analysis module in a switching system

[0067] Step a2: Utilize the packet feature acquisition module to acquire the data of the network layer and / or the transport layer and / or the data link layer in each network packet to generate a feature data segment

[0068] Step a3: Using the packet feature inspection module to inspect whether each of the feature data segments contains a protocol sub-packet in a predetermined protocol sub-packet set, so as to determine whether to generate a first permission command or a mirror command, wherein the predetermined protocol sub-packet set includes an ARP sub-packet, an ICMP sub-packet, a TCP sub-packet with SYN being 1, and a UDP sub-packet with a target network address port number being 53; if the judgment result is yes, the mirror command is in an active state so that the mirror processing module generates a mirror packet according to the network packet corresponding to the judgment result; if the judgment result is no, the first permission command is in an active state so as to drive the path control module to transmit the network packet corresponding to the judgment result to a target device

[0069] Step a4: using the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the mirror packets; if the judgment result is yes, a blocking command is in effect to drive the path control module to prohibit at least one of the network packets corresponding to the judgment result from being transmitted to the target device; if the judgment result is no, the second permission command is in effect to drive the path control module to allow at least one of the network packets corresponding to the judgment result to be transmitted to the target device, wherein the malicious behavior includes a feature selected from a group consisting of a plurality of mirror packets having the same source address but different target addresses within a predetermined time, a plurality of mirror packets having the same source address and the same target address but different port addresses within a predetermined time, a source address of the mirror packet being in a blacklist, and a source address of the mirror packet not being in a whitelist.

[0070] Step b1: Setting a path control module, a packet feature inspection module and a packet behavior analysis module in a switching system

[0071] Step b2: Using the packet feature inspection module to inspect whether each network packet contains a protocol sub-packet in a predetermined protocol sub-packet set, if the judgment result is yes, then marking each network packet corresponding to the judgment result as a suspicious network packet, if the judgment result is no, then driving the path control module to transmit each network packet corresponding to the judgment result to a target device

[0072] Step b3: Using the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the suspicious network packets, if the judgment result is yes, then driving the path control module to prohibit at least one of the suspicious network packets corresponding to the judgment result from being transmitted to the target device, if the judgment result is no, then driving the path control module to allow at least one of the suspicious network packets corresponding to the judgment result to be transmitted to the target device DETAILED DESCRIPTION

[0073] The principle of the present invention is:

[0074] (1) determining whether to regard a network packet as a suspicious network packet by checking whether the network layer, transport layer or data link layer of a network packet contains protocol sub-packets commonly used by malicious activities; and

[0075] (2) performing a malicious behavior judgment procedure on each of the suspicious network packets to determine whether to block the transmission paths of the suspicious network packets, wherein the malicious behavior refers to the appearance of multiple suspicious network packets with the same source address but different target addresses within a predetermined time (IP scanning attack), or the appearance of multiple suspicious network packets with the same source address and the same target address but different port addresses within a predetermined time (port scanning attack), or the source address of the suspicious network packet is in a blacklist (a list not allowed to access), or the source address of the suspicious network packet is not in a whitelist (a list allowed to access).

[0076] According to the above principle, the present invention can filter malicious packets in a passive manner without responding to packets, and in the filtering process, a short filtering procedure is used to minimize the impact on the transmission of normal network packets.

[0077] Please refer to Figure 1 , which shows a block diagram of an embodiment of the switching system of the present invention. Figure 1 As shown, a switching system 100 includes a path control module 110, a packet feature acquisition module 120, a mirror processing module 130, a packet feature inspection module 140 and a packet behavior analysis module 150, which are used to provide a network packet switching function with a firewall function for multiple information processing devices on a network (such as but not limited to a local area network).

[0078] The path control module 110 is used to control the first permission command C PASS1 , a second permission command C PASS2 and a blocking command C STOP Decide whether to allow a network packet D NP is transmitted to a target device, wherein when the first permission command C PASS1 or the second enabling command C PASS2 When the path control module 110 is in the active state, the network packet D NP Transmit to the target device; when blocking command C STOP When in the active state, the path control module 110 blocks the network packet D NP to the target device.

[0079] The packet feature acquisition module 120 is used to acquire the network packet D NP The network layer and / or transport layer and / or data link layer data in the embodiment of the present invention are used to generate a characteristic data segment D CH .

[0080] The mirror processing module 130 is used to process the image according to a mirror command C MR The control of each suspicious network packet D NP A mirror image package D MRThe data is sent to the packet behavior analysis module 150 .

[0081] The packet feature inspection module 140 is used to inspect each of the feature data segments D CH Whether there is a protocol sub-packet in a predetermined protocol sub-packet set in the packet, so as to determine the generation of the first permission command C PASS1 Or mirror command C MR , wherein the predetermined protocol sub-packet set includes an ARP (address resolution protocol) sub-packet, an ICMP (internet control message protocol) sub-packet, a TCP (transmission control protocol) sub-packet with a SYN (synchronization flag) of 1, and a UDP (user datagram protocol) sub-packet with a target network address port number of 53, and in the characteristic data segment D CH Any of the above sub-packets (that is, with the characteristic data segment D CH The corresponding network packet D NP For suspicious network packets), the mirror command C MR The mirror processing module 130 is in an active state so that the mirror processing module 130 receives the network packet D NP Generate mirror packet D MR , and in the characteristic data segment D CH If there is no sub-packet, the first permission command C PASS1 In the active state, the path control module 110 is driven to allow the network packet D NP transmitted to the target device.

[0082] The packet behavior analysis module 150 is used to analyze the mirror packets D MR Perform a malicious behavior judgment procedure to determine whether to block the mirror packets D MR The corresponding suspicious network packets D NP The malicious behavior refers to the occurrence of multiple mirror packets D with the same source address but different destination addresses within a predetermined time. MR (IP scanning attack), or multiple mirror packets with the same source address, the same destination address but different port addresses appear within a predetermined time. MR (port scan attack), or mirror packet D MRThe source address of the packet is in a blacklist (access denied list), which contains a network address or a domain name of a command and control server (CCS) associated with a malware, or a mirror packet D MR The source address of is not in a white list (access allowed list). When the packet behavior analysis module 150 determines that the suspicious network packets should be blocked NP The transmission path will block the command C STOP In effect to block suspicious network packets D NP When the packet behavior analysis module 150 determines that it is not necessary to block the suspicious network packets D NP The transmission path will make the second enable command C PASS2 In an active state, the suspicious network packets D NP transmitted to the target device.

[0083] In addition, in a possible embodiment, the path control module 110, the packet feature acquisition module 120 and the mirror processing module 130 can be implemented in a switch; and the packet feature inspection module 140 and the packet behavior analysis module 150 can be implemented in the same information processing device or different information processing devices.

[0084] Specifically, the switching system 100 may perform the following steps:

[0085] (I) Using the packet feature acquisition module 120 to acquire each network packet D NP The data of the network layer and / or the transport layer and / or the data link layer in the embodiment of the present invention are used to generate a characteristic data segment D CH ;

[0086] (ii) Using the packet feature check module 140 to check whether each of the characteristic data segments contains a protocol sub-packet in a predetermined protocol sub-packet set, so as to determine the generation of the first permission command C PASS1 Or mirror command C MR , wherein the predetermined protocol sub-packet set includes an ARP sub-packet, an ICMP sub-packet, a TCP sub-packet with SYN being 1, and a UDP sub-packet with a target network address port number being 53, and in the characteristic data segment D CH Any of the above sub-packets (that is, with the characteristic data segment D CH The corresponding network packet D NP For suspicious network packets), the mirror command C MR The mirror processing module 130 is in an active state so that the mirror processing module 130 receives the network packet D NP Generate mirror packet D MR , and in the characteristic data segment D CHIf there is no sub-packet, the first permission command C PASS1 In the active state, the path control module 110 is driven to allow the network packet D NP transmitting to a target device; and

[0087] (III) Using the packet behavior analysis module 150 to analyze the mirrored packets D MR Perform a malicious behavior judgment procedure to determine whether to block the mirror packets D MR The corresponding suspicious network packets D NP The malicious behavior refers to the occurrence of multiple mirror packets D with the same source address but different destination addresses within a predetermined time. MR (IP scanning attack), or multiple mirror packets with the same source address, the same destination address but different port addresses appear within a predetermined time. MR (port scan attack), or mirror packet D MR The source address of the packet is in a blacklist (access denied list), which contains a network address or a domain name of a command and control server (CCS) associated with a malware, or a mirror packet D MR The source address of the packet is not in a white list (access allowed list), and when the packet behavior analysis module 150 determines that the suspicious network packets should be blocked NP The transmission path will block the command C STOP In effect to block suspicious network packets D NP When the packet behavior analysis module 150 determines that it is not necessary to block the suspicious network packets D NP The transmission path will make the second enable command C PASS2 In an active state, the suspicious network packets D NP transmitted to the target device.

[0088] that is, Figure 1 The switching system can realize a novel method of detecting malicious network behavior. Figure 2 , which is a flow chart of an embodiment of the network malicious behavior detection method of the present invention. Figure 2As shown, the method includes: setting a path control module, a packet feature acquisition module, a mirror processing module, a packet feature inspection module and a packet behavior analysis module in a switching system (step a1); using the packet feature acquisition module to obtain data of the network layer and / or the transport layer and / or the data link layer in each network packet to generate a feature data segment (step a2); using the packet feature inspection module to check whether each of the feature data segments has a protocol sub-packet in a predetermined protocol sub-packet set to determine whether to generate a first permission command or a mirror command, wherein the predetermined protocol sub-packet set includes ARP sub-packets, ICMP sub-packets, TCP sub-packets with SYN being 1 and UDP sub-packets with a port number of 53 of the target network address. If the judgment result is yes, the mirror command is put into an active state so that the mirror processing module generates a mirror packet according to the network packet corresponding to the judgment result. If the judgment result is no, the first permission command is put into an active state to drive The path control module allows the network packet corresponding to the judgment result to be transmitted to a target device (step a3); and uses the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the mirror packets. If the judgment result is yes, a blocking command is put into effect to drive the path control module to prohibit the at least one of the network packets corresponding to the judgment result from being transmitted to the target device. If the judgment result is no, the second allowing command is put into effect to drive the path control module to allow the at least one of the network packets corresponding to the judgment result to be transmitted to the target device, wherein the malicious behavior includes a feature selected from the group consisting of a plurality of mirror packets having the same source address but different target addresses appearing within a predetermined time, a plurality of mirror packets having the same source address and the same target address but different port addresses appearing within a predetermined time, the source address of the mirror packet being in a blacklist, and the source address of the mirror packet being not in a whitelist (step a4).

[0089] According to the above description, the present invention can effectively block the attack of malicious devices on normal information processing devices without affecting the network access experience of normal information processing devices. Figure 3 , which is Figure 1 A schematic diagram of an application example of a switching system. Figure 3 As shown, in this application example, the switching system 100 is coupled to information processing devices 200a, 200b and a malicious device 200c respectively to process network packets sent by the information processing devices 200a, 200b and the malicious device 200c. Figure 4a When the information processing device 200a sends a network packet D destined for the information processing device 200b NP , that is, when normal information processing devices communicate with each other through the network, the switching system 100 executes Figure 2 The method will make the network packet D NP Transmitted to the information processing device 200b; and please refer to Figure 4b , when the malicious device 200c sends a network packet D targeting the information processing device 200b NP , that is, when a malicious device attacks a normal information processing device, the switching system 100 executes Figure 2 The network packet D will be intercepted after the method NP .

[0090] In addition, since all network packets D NP The malicious behavior judgment process will not have a significant impact on the network access experience. Therefore, in a possible embodiment, the switching system 100 may have a flow detection function to detect the malicious behavior of the network packet D NP When the traffic is lower than a threshold, all network packets D NP All are put into the packet behavior analysis module 150 to perform the malicious behavior judgment procedure. For example, the packet feature inspection module 140 may have a flow detection procedure to obtain the feature data segment D CH A flow value, and when the flow value is lower than a threshold, the mirror command C MR In active state, so that each network packet D NP are processed by the mirror processing module 130 to generate a mirror packet D MR Or use the packet feature acquisition module 120 to execute a flow detection program to obtain the network packet D NP and when the traffic value is lower than a threshold, each network packet D NP The mirror processing module 130 processes the mirror packet D. MR Alternatively, a traffic detection module may be added to detect network packets D NP or characteristic data segment D CH and when the traffic value is lower than a threshold, the mirror processing module 130 is driven to transmit the network packet D NP Generate mirror packet D MR .

[0091] According to the above detailed description, the present invention further proposes another embodiment of the switching system of the present invention. Figure 5 , which shows a block diagram of another embodiment of the switching system of the present invention. Figure 5As shown, a switching system 300 includes a path control module 310, a packet feature inspection module 320 and a packet behavior analysis module 330, which are used to provide a network packet switching function with a firewall function for multiple information processing devices on a network (such as but not limited to a local area network).

[0092] The path control module 310 is used to control the first permission command C PASS1 , a second permission command C PASS2 and a blocking command C STOP Decide whether to allow a network packet D NP is transmitted to a target device, wherein when the first permission command C PASS1 or the second enabling command C PASS2 When the path control module 310 is in the active state, the network packet D NP Transmit to the target device; when blocking command C STOP When in the active state, the path control module 310 blocks the network packet D NP to the target device.

[0093] The packet feature inspection module 320 is used to inspect each network packet D NP whether there is a protocol sub-packet in a predetermined protocol sub-packet set, if the judgment result is yes, then each network packet D corresponding to the judgment result NP Marked as a suspicious network packet D NPQ If the judgment result is no, the first permission command C PASS1 The path control module 310 is in an active state to allow each network packet D corresponding to the judgment result to be NP The method is directed to a target device, wherein the predetermined protocol sub-packet set includes an ARP (address resolution protocol) sub-packet, an ICMP (internet control message protocol) sub-packet, a TCP (transmission control protocol) sub-packet with a SYN (synchronization flag) of 1, and a UDP (user datagram protocol) sub-packet with a port number of 53 of the target network address.

[0094] The packet behavior analysis module 330 is used to analyze at least one of the suspicious network packets D NPQ Perform a malicious behavior judgment procedure. If the judgment result is yes, then block the command C STOP The path control module 310 is in an active state to prohibit the transmission of at least one suspicious network packet corresponding to the judgment result.NPQ to the target device, if the judgment result is no, the second permission command C PASS2 The path control module 310 is in an active state to allow at least one suspicious network packet D corresponding to the judgment result. NPQ The malicious behavior refers to the occurrence of multiple suspicious network packets with the same source address but different destination addresses within a predetermined period of time. NPQ (IP scanning attack), or multiple suspicious network packets with the same source address, the same destination address but different port addresses appear within a predetermined time. NPQ (Port scan attack), or suspicious network packet D NPQ The source address of the packet is in a blacklist (access denied list), which contains a network address or a domain name of a command and control server associated with a malware, or a suspicious network packet D NPQ The source address of the packet is not in a whitelist (allowed access list).

[0095] according to Figure 5 The present invention further proposes another embodiment of the network malicious behavior detection method of the present invention. Figure 6 , which is a flow chart of another embodiment of the network malicious behavior detection method of the present invention. Figure 6 As shown, the method includes: setting a path control module, a packet feature inspection module and a packet behavior analysis module in a switching system (step b1); using the packet feature inspection module to check whether each network packet has a protocol sub-packet in a predetermined protocol sub-packet set, if the judgment result is yes, then marking each network packet corresponding to the judgment result as a suspicious network packet, if the judgment result is no, then driving the path control module to allow each network packet corresponding to the judgment result to be transmitted to a target device (step b2); and using the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the suspicious network packets, if the judgment result is yes, then driving the path control module to prohibit at least one of the suspicious network packets corresponding to the judgment result from being transmitted to the target device, if the judgment result is no, then driving the path control module to allow at least one of the suspicious network packets corresponding to the judgment result to be transmitted to the target device (step b3).

[0096] In step b2, the predetermined protocol sub-packet set includes an ARP sub-packet, an ICMP sub-packet, a TCP sub-packet with SYN being 1, and a UDP sub-packet with a port number of 53 of the target network address.

[0097] In step b3, the malicious behavior may be the appearance of multiple mirror packets with the same source address but different target addresses within a predetermined time, the appearance of multiple mirror packets with the same source address, the same target address but different port addresses within a predetermined time, the source address of the mirror packet is in a blacklist, the blacklist includes a network address or a domain name of a command and control relay host (Command and Control Server) associated with a malware, or the source address of the mirror packet is not in a whitelist.

[0098] Through the above disclosed design, the present invention has the following advantages:

[0099] 1. The network malicious behavior detection method of the present invention can provide a firewall effect with almost zero impact on network traffic and network speed through a two-stage filtering program.

[0100] 2. The network malicious behavior detection method of the present invention filters malicious packets in a passive manner without responding to packets, so it will not affect the transmission speed of normal network packets compared to the existing active method that requires responding to packets.

[0101] The present disclosure discloses preferred embodiments. Any local changes or modifications that are derived from the technical concept of the present disclosure and are easily inferred by those skilled in the art do not depart from the scope of the claims of the present disclosure.

[0102] In summary, the present invention is very different from the prior art in terms of purpose, means and technical effects. Moreover, its invention is practical and indeed meets the patent requirements for inventions. We sincerely ask the examiner to carefully examine this and grant the patent as soon as possible to benefit the society. This is our utmost prayer.

Claims

1. A method for detecting malicious behavior in an internal network, which is implemented by a switching system, the switching system having a path control module, a packet feature acquisition module, a mirror processing module, a packet feature inspection module and a packet behavior analysis module, the method comprising: Utilizing the packet feature acquisition module to acquire data of the network layer and / or the transport layer and / or the data link layer in each internal network packet to generate a feature data segment respectively; Using the packet feature inspection module to inspect whether each of the feature data segments contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, driving the mirror processing module to generate a mirror packet according to the internal network packet corresponding to the determination result, if not, driving the path control module to transmit the internal network packet corresponding to the determination result to a target device; as well as Using the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the mirrored packets, if the judgment result is yes, driving the path control module to prohibit at least one of the internal network packets corresponding to the judgment result from being transmitted to the target device, if the judgment result is no, driving the path control module to allow at least one of the internal network packets corresponding to the judgment result to be transmitted to the target device; The predetermined protocol sub-packet set includes ARP sub-packets, ICMP sub-packets, TCP sub-packets and UDP sub-packets.

2. The method for detecting malicious behavior in an internal network as claimed in claim 1, wherein: The TCP sub-packet is a TCP sub-packet with SYN being 1, and the UDP sub-packet is a UDP sub-packet with the port number of the target network address being 53.

3. An internal network malicious behavior detection method as described in claim 1, wherein the malicious behavior includes a feature selected from the group consisting of a plurality of mirror packets with the same source address but different target addresses appearing within a predetermined time, a plurality of mirror packets with the same source address, the same target address but different port addresses appearing within a predetermined time, the source address of the mirror packet being in a blacklist, and the source address of the mirror packet not being in a whitelist.

4. The internal network malicious behavior detection method as described in claim 1 further comprises: using a traffic detection module to put all the network packets into the packet behavior analysis module to perform the malicious behavior judgment program when the traffic of the internal network packets is lower than a threshold; or using the packet feature acquisition module to execute a traffic detection program to obtain a traffic value of the network packets, and when the traffic value is lower than a threshold, each of the internal network packets is processed by the mirror processing module to generate a mirror packet; or using the packet feature inspection module to execute a traffic detection program to obtain a traffic value of the characteristic data segment, and when the traffic value is lower than a threshold, each of the internal network packets is processed by the mirror processing module to generate a mirror packet.

5. A switching system, arranged on a network, having a path control module, a packet feature acquisition module, a mirror processing module, a packet feature inspection module and a packet behavior analysis module to execute an internal network malicious behavior detection method, the method comprising: Utilizing the packet feature acquisition module to acquire data of the network layer and / or the transport layer and / or the data link layer in each internal network packet to generate a feature data segment respectively; Using the packet feature inspection module to inspect whether each of the feature data segments contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, driving the mirror processing module to generate a mirror packet according to the internal network packet corresponding to the determination result, if not, driving the path control module to transmit the internal network packet corresponding to the determination result to a target device; as well as Using the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the mirrored packets, if the judgment result is yes, driving the path control module to prohibit at least one of the internal network packets corresponding to the judgment result from being transmitted to the target device, if the judgment result is no, driving the path control module to allow at least one of the internal network packets corresponding to the judgment result to be transmitted to the target device; The predetermined protocol sub-packet set includes ARP sub-packets, ICMP sub-packets, TCP sub-packets and UDP sub-packets.

6. The switching system according to claim 5, wherein: The path control module, the packet feature acquisition module and the mirror processing module are implemented in a switch.

7. The switching system according to claim 5, wherein: The packet feature inspection module and the packet behavior analysis module are implemented in the same information processing device or in different information processing devices.

8. The switching system according to claim 5, wherein: The TCP sub-packet is a TCP sub-packet with SYN being 1, and the UDP sub-packet is a UDP sub-packet with the port number of the target network address being 53.

9. The switching system of claim 5, wherein the malicious behavior comprises a feature selected from a group consisting of a plurality of mirrored packets having the same source address but different target addresses appearing within a predetermined time, a plurality of mirrored packets having the same source address, the same target address but different port addresses appearing within a predetermined time, the source address of the mirrored packet being in a blacklist, and the source address of the mirrored packet being not in a whitelist.

10. The switching system according to claim 9, wherein: The blacklist includes a network address or a domain name of a command and control relay host associated with a malware.

11. The switching system according to claim 5, wherein: The internal network malicious behavior detection method further comprises: using a flow detection module to put all the internal network packets into the packet behavior analysis module to perform the malicious behavior judgment procedure when the flow of the internal network packets is lower than a threshold; or using the packet feature acquisition module to execute a flow detection procedure to obtain a flow value of the internal network packets, and when the flow value is lower than a threshold, each of the internal network packets is processed by the mirror processing module to generate a mirror packet; Or the packet feature inspection module is used to execute a flow detection program to obtain a flow value of the characteristic data segment, and when the flow value is lower than a threshold, each internal network packet is processed by the mirror processing module to generate a mirror packet.

12. The switching system according to claim 5, wherein: The network is a regional network.

13. A method for detecting malicious behavior in an internal network, which is implemented by a switching system, the switching system having a path control module, a packet feature inspection module and a packet behavior analysis module, the method comprising: Using the packet feature inspection module to inspect whether each internal network packet contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, marking each internal network packet corresponding to the determination result as a suspicious network packet, if the determination result is no, driving the path control module to transmit each internal network packet corresponding to the determination result to a target device; as well as Using the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the suspicious network packets, if the judgment result is yes, driving the path control module to prohibit at least one of the suspicious network packets corresponding to the judgment result from being transmitted to the target device, if the judgment result is no, driving the path control module to allow at least one of the suspicious network packets corresponding to the judgment result to be transmitted to the target device; The predetermined protocol sub-packet set includes ARP sub-packets, ICMP sub-packets, TCP sub-packets and UDP sub-packets.

14. The method for detecting malicious behavior in an internal network according to claim 13, wherein: The TCP sub-packet is a TCP sub-packet with SYN being 1, and the UDP sub-packet is a UDP sub-packet with the port number of the target network address being 53.

15. An internal network malicious behavior detection method as described in claim 13, wherein the malicious behavior includes a feature selected from the group consisting of a plurality of suspicious network packets with the same source address but different target addresses appearing within a predetermined time, a plurality of suspicious network packets with the same source address, the same target address but different port addresses appearing within a predetermined time, the source address of the suspicious network packet being in a blacklist, and the source address of the suspicious network packet being not in a whitelist.

16. The internal network malicious behavior detection method as described in claim 13 further comprises: utilizing a traffic detection module to place all the internal network packets into the packet behavior analysis module to perform the malicious behavior judgment procedure when the traffic of the internal network packets is lower than a threshold; or utilizing the packet feature inspection module to execute a traffic detection procedure to obtain a traffic value of the internal network packets, and when the traffic value is lower than a threshold, placing all the internal network packets into the packet behavior analysis module to perform the malicious behavior judgment procedure.

17. A switching system, arranged on a network, having a path control module, a packet feature inspection module and a packet behavior analysis module to execute an internal network malicious behavior detection method, the method comprising: Using the packet feature inspection module to inspect whether each internal network packet contains a protocol sub-packet in a predetermined protocol sub-packet set, if the determination result is yes, marking each internal network packet corresponding to the determination result as a suspicious network packet, if the determination result is no, driving the path control module to transmit each internal network packet corresponding to the determination result to a target device; as well as Using the packet behavior analysis module to perform a malicious behavior judgment procedure on at least one of the suspicious network packets, if the judgment result is yes, driving the path control module to prohibit at least one of the suspicious network packets corresponding to the judgment result from being transmitted to the target device, if the judgment result is no, driving the path control module to allow at least one of the suspicious network packets corresponding to the judgment result to be transmitted to the target device; The predetermined protocol sub-packet set includes ARP sub-packets, ICMP sub-packets, TCP sub-packets and UDP sub-packets.

18. The switching system of claim 17, wherein: The TCP sub-packet is a TCP sub-packet with SYN being 1, and the UDP sub-packet is a UDP sub-packet with the port number of the target network address being 53.

19. The switching system of claim 17, wherein: The malicious behavior includes a feature selected from a group consisting of the following: multiple suspicious network packets with the same source address but different destination addresses appear within a predetermined time; multiple suspicious network packets with the same source address, the same destination address but different port addresses appear within a predetermined time; the source address of the suspicious network packet is in a blacklist; and the source address of the suspicious network packet is not in a whitelist.

20. The switching system of claim 19, wherein: The blacklist includes a network address or a domain name of a command and control relay host associated with a malware.

21. The switching system of claim 17, wherein: The internal network malicious behavior detection method further includes: using a traffic detection module to put all the internal network packets into the packet behavior analysis module to perform the malicious behavior judgment procedure when the traffic of the internal network packets is lower than a threshold; or using the packet feature inspection module to execute a traffic detection procedure to obtain a traffic value of the internal network packets, and when the traffic value is lower than a threshold, all the internal network packets are put into the packet behavior analysis module to perform the malicious behavior judgment procedure.

Images