Intrusion detection method and electronic device, storage medium

Abstract

The application provides an intrusion detection method, an electronic device and a storage medium. The method comprises the following steps: a network card driver receives a data packet, calls an XDP program on an XDP network hook, and submits the data packet to an intrusion detection module through the XDP program; the intrusion detection module detects the data packet, and obtains a processing action corresponding to a detection result; the XDP program obtains the processing action returned by the intrusion detection module, and processes the data packet according to the processing action. According to the application, the intrusion detection module is deployed in an application layer, and only key fields need to be analyzed for detection, so that the detection rate of the data packet is greatly improved. Compared with the related art, the application can detect the data packet before the data packet enters a protocol stack through the intrusion detection system in the application layer, and the intrusion detection is realized in a low deployment difficulty.

Description

Technical Field

[0001] This application relates to the field of communication security technology, and in particular to an intrusion detection method, electronic device, and computer-readable storage medium. Background Technology

[0002] Cybersecurity is especially crucial in today's ubiquitous internet communication environment. Enterprises providing internet services can use Intrusion Prevention Systems (IPS) to identify and block malicious traffic from entering their networks. Typically, IPS functionality is deployed on the inbound traffic side to monitor and inspect inbound traffic for vulnerabilities and exploits. If a threat is detected, appropriate measures are taken according to security defense strategies, such as blocking access, isolating the host, or blocking access to external websites to prevent the introduction of potential threats. See also Figure 1 This is a schematic diagram of the architecture of intrusion detection methods in related technologies. For example... Figure 1 As shown, in related technologies, intrusion detection systems are deployed on the network protocol stack of the security host kernel layer. After the network interface card (NIC) of the security device receives a packet, it passes the packet to the network protocol stack. The network protocol stack parses the packet before sending it to the application at the application layer. Therefore, an intrusion detection system deployed on the network protocol stack can perform security checks on packets.

[0003] However, network protocol stacks are feature-rich and complex to implement. Intrusion detection systems need to perform security checks on information in packets at the link layer, network layer, transport layer, and application layer. Therefore, they need to be deployed in multiple locations in the protocol stack, making implementation quite complex. Summary of the Invention

[0004] The purpose of this application is to provide an intrusion detection method, electronic device, and computer-readable storage medium that can achieve intrusion detection with low deployment difficulty.

[0005] On the one hand, this application provides an intrusion detection method, including:

[0006] When the network card driver receives a data packet, it calls the XDP program on the XDP network hook and submits the data packet to the intrusion detection module through the XDP program.

[0007] The intrusion detection module detects the data packet and obtains the processing action corresponding to the detection result;

[0008] The XDP program obtains the processing action returned by the intrusion detection module and processes the data packet according to the processing action.

[0009] The above measures significantly improve the packet detection rate. Compared to related technologies, this application's solution utilizes an application-layer intrusion detection system to detect packets before they enter the protocol stack, achieving intrusion detection with relatively low deployment complexity.

[0010] In one embodiment, the XDP program includes an XDP filtering program and an XDP message processing program, wherein the XDP filtering program is used to filter out data packets to be detected, and the XDP message processing program is used to submit data packets and process data packets.

[0011] The step of invoking the XDP program on the XDP network hook and submitting the data packet to the intrusion detection module through the XDP program includes:

[0012] The XDP filtering program on the XDP network hook is invoked to filter the data packets and obtain the data packets to be detected.

[0013] The XDP packet processing program on the XDP network hook is invoked, and the data packets to be detected are submitted to the intrusion detection module through the XDP packet processing program.

[0014] By implementing the above measures, targeted detection of high-threat data packets can be performed, thereby reducing the computational load of the intrusion detection module and improving overall detection efficiency.

[0015] In one embodiment, before the XDP program on the XDP network hook is invoked, and the packet is submitted to the intrusion detection module via the XDP program, the method further includes:

[0016] The intrusion detection module parses a preset filtering rule file to obtain filtering rules; wherein, the filtering rules are used to filter out the data packets to be detected.

[0017] The intrusion detection module generates the XDP filtering program for the filtering rules and writes the XDP filtering program carrying the filtering rules into the XDP network hook.

[0018] By implementing the above measures, the XDP filtering program on the XDP network hook can then filter out the data packets to be detected, thereby reducing the computational load of the intrusion detection module.

[0019] In one embodiment, the XDP program includes an XDP whitelisting program and an XDP packet processing program, wherein the XDP whitelisting program is used for data packets passing through trusted traffic, and the XDP packet processing program is used for submitting data packets and processing data packets.

[0020] The step of invoking the XDP program on the XDP network hook and submitting the data packet to the intrusion detection module through the XDP program includes:

[0021] The XDP whitelist program on the XDP network hook is invoked. The XDP whitelist program checks for packets that match the whitelist and submits the packets that match the whitelist to the protocol stack.

[0022] The XDP packet processing program on the XDP network hook is invoked, and packets that do not match the whitelist are submitted to the intrusion detection module through the XDP packet processing program.

[0023] By implementing the above measures, a whitelist can be set up to exempt trusted traffic from inspection, thereby reducing the computational load of the intrusion detection module and improving the overall processing efficiency of data packets.

[0024] In one embodiment, before the XDP program on the XDP network hook is invoked, and the packet is submitted to the intrusion detection module via the XDP program, the method further includes:

[0025] The intrusion detection module parses a preset whitelist file to obtain the whitelist.

[0026] The intrusion detection module generates the XDP whitelist program for the whitelist and writes the XDP whitelist program carrying the whitelist into the XDP network hook.

[0027] By implementing the above measures, the XDP whitelist program on the XDP network hook can then directly access trusted traffic packets, thereby reducing the computational load on the intrusion detection module.

[0028] In one embodiment, the XDP program includes an XDP blacklist program and an XDP packet processing program, wherein the XDP blacklist program is used to block packets of abnormal traffic, and the XDP packet processing program is used to submit packets and process packets.

[0029] The step of invoking the XDP program on the XDP network hook and submitting the data packet to the intrusion detection module through the XDP program includes:

[0030] Invoke the XDP blacklist program on the XDP network hook, check the packets that hit the blacklist through the XDP blacklist program, and discard the packets that hit the blacklist.

[0031] The XDP packet processing program on the XDP network hook is invoked, and packets that do not match the blacklist are submitted to the intrusion detection module through the XDP packet processing program.

[0032] By implementing the above measures, a blacklist can be set up to block abnormal traffic at the network card driver level, thereby reducing the computational load of the intrusion detection module and improving the overall data packet processing efficiency.

[0033] In one embodiment, before the XDP program on the XDP network hook is invoked, and the packet is submitted to the intrusion detection module via the XDP program, the method further includes:

[0034] The intrusion detection module parses a preset blacklist file to obtain the blacklist.

[0035] The intrusion detection module generates the XDP blacklist program for the blacklist and writes the XDP blacklist program carrying the blacklist into the XDP network hook.

[0036] By implementing the above measures, abnormal traffic packets can be directly dropped by the XDP blacklist program on the XDP network hook, thereby reducing the computational load of the intrusion detection module.

[0037] In one embodiment, after writing the XDP blacklist-carrying program carrying the blacklist into the XDP network hook, the method further includes:

[0038] The intrusion detection module identifies several abnormal traffic flows based on historical detection results over a specified time period and generates a blacklist for these abnormal traffic flows.

[0039] The intrusion detection module sends the generated blacklist to the XDP blacklist program.

[0040] The above measures can dynamically update the blacklist of the XDP blacklist program, allowing it to discard packets of abnormal traffic based on the latest blacklist.

[0041] On the other hand, this application provides an electronic device, the electronic device comprising:

[0042] processor;

[0043] Memory used to store processor-executable instructions;

[0044] The processor is configured to execute the intrusion detection method described above.

[0045] In addition, this application provides a computer-readable storage medium storing a computer program that can be executed by a processor to perform the above-described intrusion detection method. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly described below.

[0047] Figure 1 This is a schematic diagram of the architecture of intrusion detection methods in related technologies;

[0048] Figure 2 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0049] Figure 3 A schematic flowchart of an intrusion detection method provided in an embodiment of this application;

[0050] Figure 4 A schematic diagram of the architecture of an intrusion detection method provided in an embodiment of this application;

[0051] Figure 5 This is a flowchart illustrating an intrusion detection method provided in another embodiment of this application. Detailed Implementation

[0052] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0053] Similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0054] like Figure 2 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12. Figure 2 Taking a processor 11 as an example, the processor 11 and memory 12 are connected via bus 10. Memory 12 stores instructions that can be executed by the processor 11. The instructions are executed by the processor 11 to enable the electronic device 1 to perform all or part of the processes of the methods described in the embodiments below. In one embodiment, the electronic device 1 may be a security device of a server (e.g., a firewall), a server, or a vehicle gateway for performing intrusion detection methods. For ease of description, the electronic device is referred to as the execution subject below.

[0055] The memory 12 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0056] This application also provides a computer-readable storage medium storing a computer program that can be executed by a processor 11 to perform the intrusion detection method provided in this application.

[0057] See Figure 3 This is a flowchart illustrating an intrusion detection method provided in an embodiment of this application, as shown below. Figure 3 As shown, the method may include the following steps 310-330.

[0058] Step 310: The network card driver receives the data packet, calls the XDP program on the XDP network hook, and submits the data packet to the intrusion detection module through the XDP program.

[0059] After receiving data packets from an external network, the network interface card (NIC) of an electronic device can submit the data packets to the NIC driver. The NIC driver is configured with an XDP (eXpress Data Path) network hook, and the XDP network hook has an XDP program configured.

[0060] After receiving a data packet, the network interface card (NIC) driver can call the XDP program to process the packet. The XDP program can then forward the packet to the application-layer intrusion detection module via the XDP_REDIRECT mechanism.

[0061] See Figure 4 This is a schematic diagram of the architecture of an intrusion detection method provided in an embodiment of this application, as shown below. Figure 4 As shown, the intrusion detection module resides at the application layer, not in the protocol stack. The intrusion detection module can listen to the XDP program through an AF_XDP type socket, thereby receiving the data packets forwarded by the XDP program.

[0062] Step 320: The intrusion detection module detects the data packets and obtains the processing action corresponding to the detection result.

[0063] After receiving a data packet, the intrusion detection module can perform protocol parsing on the data packet and extract various key fields from it, such as the MAC (Media Access Control Address) address at the link layer; the IP (Internet Protocol Address), FLAG, fragmentation, and other information at the network layer; the port, flag bits, and other information at the transport layer; and the message data at the application layer.

[0064] The intrusion detection module can perform various anomaly detections based on extracted key fields and packet context information. For example, anomaly types may include ARP (Address Resolution Protocol) spoofing, packet fragmentation attacks, and flooding attacks. After detection, it can be determined whether the packet belongs to abnormal traffic. If the packet is abnormal traffic, the appropriate action is to drop it (XDP_DROP). If the packet is normal traffic, the appropriate action is to forward it (XDP_PASS).

[0065] After receiving the processing action, the intrusion detection module can return the processing action to the XDP program.

[0066] Step 330: The XDP program obtains the processing action returned by the intrusion detection module and processes the data packet according to the processing action.

[0067] The XDP program receives a processing action, which allows it to process the data packet. One processing action is to drop the packet; another is to forward it, submitting the packet to the protocol stack so that it can be passed from the protocol stack to other applications at the application layer for processing.

[0068] Because the protocol stack pays close attention to data packets and its parsing is complex, intrusion detection modules deployed on the protocol stack require more time to detect data packets. In contrast, the intrusion detection module in this application is deployed at the application layer, requiring only the parsing of key fields for detection, thus significantly improving the data packet detection speed. Compared to related technologies, this application's solution, through an application-layer intrusion detection system, detects data packets before they enter the protocol stack, achieving intrusion detection with lower deployment complexity. Furthermore, since the intrusion detection module does not require customization for different systems or kernel versions, it has high portability; the porting process only requires simple configuration on the target device to implement intrusion detection and defense functions.

[0069] See Figure 5 This is a flowchart illustrating an intrusion detection method provided in another embodiment of this application, as shown below. Figure 5 As shown, after a network data packet enters the network interface card (NIC), the XDP program in the NIC driver can submit the packet to the intrusion detection module (intrusion process engine). The intrusion detection module checks if the data packet process is abnormal and returns a corresponding processing action to the XDP program. The XDP program determines whether to discard the data packet based on the processing action and processes the data packet accordingly.

[0070] In one embodiment, the XDP program includes an XDP filtering program and an XDP message processing program. The XDP filtering program filters out data packets to be detected, and the XDP message processing program submits and processes the data packets.

[0071] When the XDP program is invoked and data packets are submitted to the intrusion detection module, the network card driver can call the XDP filtering program and the XDP packet processing program.

[0072] The XDP filtering program can filter data packets according to filtering rules to obtain the data packets to be inspected. Here, filtering rules are used to filter out data packets that may pose a threat. Filtering rules can be determined by one or more fields such as IP, MAC, protocol, and port.

[0073] After filtering out the packets to be inspected, the XDP packet handler can submit these packets to the intrusion detection module. The filtered packets, considered non-threatening, can be submitted to the protocol stack by the XDP packet handler.

[0074] In this embodiment, the subsequent XDP message processing program can receive processing actions from the intrusion detection module and then process the data packets.

[0075] By implementing the above measures, targeted detection of high-threat data packets can be performed, thereby reducing the computational load of the intrusion detection module and improving overall detection efficiency.

[0076] In one embodiment, before submitting data packets to the intrusion detection module via the XDP program, the intrusion detection module can write an XDP message processing program on the XDP network hook, so that data packets received by the network card driver can be submitted to the intrusion detection module via the XDP message processing program.

[0077] In one embodiment, before submitting data packets to the intrusion detection module via the XDP program, the intrusion detection module can parse a preset filtering rule file to obtain filtering rules. The filtering rule file records at least one user-configured filtering rule; the filtering rule is used to filter out data packets to be detected.

[0078] The intrusion detection module can generate XDP filter routines for filtering rules, which are then used to execute those rules. The intrusion detection module can write these XDP filter routines, carrying the filtering rules, into the XDP network hook. The XDP filter routines written into the XDP network hook are processed before the XDP packet processing routines.

[0079] By implementing the above measures, the XDP filtering program on the XDP network hook can then filter out the data packets to be detected, thereby reducing the computational load of the intrusion detection module.

[0080] In one embodiment, the XDP program includes an XDP whitelisting program and an XDP packet processing program. The XDP whitelisting program is used for packets passing through trusted traffic, which is traffic that does not require detection. The XDP packet processing program is used to submit and process packets.

[0081] When the XDP program is invoked and data packets are submitted to the intrusion detection module, the network card driver can call the XDP whitelist program and the XDP packet processing program.

[0082] The XDP whitelisting program checks whether data packets match the whitelist, which records trusted traffic. It extracts information from one or more fields such as IP address, MAC address, protocol, and port from data packets and determines whether the extracted information matches the whitelist. If a data packet matches the whitelist, the XDP whitelisting program can directly submit it to the protocol stack. If a data packet does not match the whitelist, the XDP packet processing program can submit it to the intrusion detection module.

[0083] By implementing the above measures, a whitelist can be set up to exempt trusted traffic from inspection, thereby reducing the computational load of the intrusion detection module and improving the overall processing efficiency of data packets.

[0084] In one embodiment, before submitting data packets to the intrusion detection module via the XDP program, the intrusion detection module can parse a preset whitelist file to obtain a whitelist. The whitelist file records at least one user-configured whitelist entry. The whitelist indicates trusted traffic using information from one or more fields such as IP address, MAC address, protocol, and port.

[0085] The intrusion detection module can generate an XDP whitelist program for the whitelist, which is used to filter packets from trusted traffic. The intrusion detection module can write the XDP whitelist program carrying the whitelist into the XDP network hook. The XDP whitelist program written into the XDP network hook is processed before the XDP packet processing program.

[0086] By implementing the above measures, the XDP whitelist program on the XDP network hook can then directly access trusted traffic packets, thereby reducing the computational load on the intrusion detection module.

[0087] In one embodiment, the XDP program includes an XDP blacklist program and an XDP packet processing program. The XDP blacklist program is used to block packets with abnormal traffic. The XDP packet processing program is used to submit and process packets.

[0088] When the XDP program is invoked and data packets are submitted to the intrusion detection module, the network card driver can call the XDP blacklist program and the XDP packet processing program.

[0089] The XDP blacklist program checks whether data packets match the blacklist, which records abnormal traffic. It extracts information from one or more fields such as IP address, MAC address, protocol, and port from data packets and determines whether the extracted information matches the blacklist. If a data packet matches the blacklist, the XDP blacklist program discards it. If a data packet does not match the blacklist, the XDP packet processing program submits it to the intrusion detection module.

[0090] By implementing the above measures, a blacklist can be set up to block abnormal traffic at the network card driver level, thereby reducing the computational load of the intrusion detection module and improving the overall data packet processing efficiency.

[0091] In one embodiment, before submitting data packets to the intrusion detection module via the XDP program, the intrusion detection module can parse a preset blacklist file to obtain a blacklist. The blacklist file records at least one user-configured blacklist entry. The blacklist indicates abnormal traffic using information from one or more fields such as IP address, MAC address, protocol, and port.

[0092] The intrusion detection module can generate an XDP blacklist program, which is used to filter packets with abnormal traffic. The intrusion detection module can write the XDP blacklist program carrying the blacklist into the XDP network hook. The XDP blacklist program written into the XDP network hook is processed before the XDP packet processing program.

[0093] By implementing the above measures, abnormal traffic packets can be directly dropped by the XDP blacklist program on the XDP network hook, thereby reducing the computational load of the intrusion detection module.

[0094] In one embodiment, after the intrusion detection module writes the XDP blacklist program into the XDP network hook, it can dynamically update the blacklist in the XDP blacklist program.

[0095] The intrusion detection module can identify a number of abnormal traffic flows based on historical detection results for a specified time period. This specified time period can be configured as needed; for example, it could be the month preceding the generation of the blacklist. The intrusion detection module can also identify frequently occurring abnormal traffic flows from historical detection results. For example, it can identify frequently occurring abnormal traffic flows using evaluation metrics such as the number of occurrences or frequency of occurrence. Finally, the intrusion detection module can generate a blacklist for the selected abnormal traffic flows.

[0096] Furthermore, the intrusion detection module can distribute dynamically generated blacklists to the XDP blacklist program, allowing the XDP blacklist program to filter out abnormal traffic packets based on the updated blacklist. The intrusion detection module can also periodically update the XDP blacklist program's blacklist, enabling the XDP blacklist program to discard abnormal traffic packets based on the latest blacklist.

[0097] In one embodiment, the XDP program may include an XDP message processing program, and one or more combinations of an XDP whitelist program, an XDP blacklist program, and an XDP filtering program, thereby more precisely filtering out the data packets to be detected before submitting them to the intrusion detection module, reducing the computational load of the intrusion detection module, and improving the overall working efficiency of the electronic device.

[0098] The deployment of this solution is relatively simple. The XDP attribute in the network interface card (NIC) can be enabled using the `iplink` command on the electronic device, and an intrusion detection module can be deployed at the application layer. The intrusion detection module is started via command line, specifying the storage paths for preset filtering rule files, preset whitelist files, and preset blacklist files. The intrusion detection module can read the corresponding files, parse them, and generate an XDP program, which is then written to the XDP network hook. This allows for subsequent detection of data packets submitted by the XDP program.

[0099] This application offers high flexibility. The intrusion detection module is deployed at the application layer. In case of rule updates or software updates, only the corresponding files need to be replaced or a new version of the application needs to be installed. There is no need to modify the kernel code and recompile.

Claims

1. An intrusion detection method, characterized in that, include: When the network card driver receives a data packet, it calls the XDP program on the XDP network hook, and submits the data packet to the intrusion detection module located at the application layer through the XDP program. The intrusion detection module detects the data packets at the application layer and obtains the processing action corresponding to the detection result; The XDP program obtains the processing action returned by the intrusion detection module and processes the data packet according to the processing action; The XDP program includes an XDP target list program and an XDP message processing program, wherein the XDP message processing program is used to submit data packets and process data packets; Invoking the XDP program on the XDP network hook, and submitting the data packet to the intrusion detection module located at the application layer through the XDP program, includes: The XDP target list program on the XDP network hook is invoked, and packets that do not match the target list are checked through the XDP target list program. The XDP packet processing program on the XDP network hook is invoked, and packets that do not match the target list are submitted to the intrusion detection module through the XDP packet processing program.

2. The method according to claim 1, characterized in that, The XDP program also includes an XDP filtering program, which is used to filter out data packets to be detected. The step of invoking the XDP program on the XDP network hook, and submitting the data packet to the intrusion detection module located at the application layer through the XDP program, further includes: The XDP filtering program on the XDP network hook is invoked to filter the data packets and obtain the data packets to be detected. The XDP packet processing program on the XDP network hook is invoked, and the data packets to be detected are submitted to the intrusion detection module through the XDP packet processing program.

3. The method according to claim 2, characterized in that, Before invoking the XDP program on the XDP network hook and submitting the data packet to the intrusion detection module via the XDP program, the method further includes: The intrusion detection module parses a preset filtering rule file to obtain filtering rules; wherein, the filtering rules are used to filter out the data packets to be detected. The intrusion detection module generates the XDP filtering program for the filtering rules and writes the XDP filtering program carrying the filtering rules into the XDP network hook.

4. The method according to claim 1, characterized in that, The XDP target list program is an XDP whitelist program, which is used to manage data packets passing through trusted traffic. The step of invoking the XDP program on the XDP network hook, and submitting the data packet to the intrusion detection module located at the application layer through the XDP program, further includes: The XDP whitelist program on the XDP network hook is invoked. The XDP whitelist program checks for packets that match the whitelist and submits the packets that match the whitelist to the protocol stack.

5. The method according to claim 4, characterized in that, Before invoking the XDP program on the XDP network hook and submitting the data packet to the intrusion detection module located at the application layer via the XDP program, the method further includes: The intrusion detection module parses a preset whitelist file to obtain the whitelist. The intrusion detection module generates the XDP whitelist program for the whitelist and writes the XDP whitelist program carrying the whitelist into the XDP network hook.

6. The method according to claim 1, characterized in that, The XDP target list program and XDP blacklist program are used to block packets of abnormal traffic. The step of invoking the XDP program on the XDP network hook, and submitting the data packet to the intrusion detection module located at the application layer through the XDP program, further includes: The XDP blacklist program on the XDP network hook is invoked to check packets that hit the blacklist and discard such packets.

7. The method according to claim 6, characterized in that, Before invoking the XDP program on the XDP network hook and submitting the data packet to the intrusion detection module located at the application layer via the XDP program, the method further includes: The intrusion detection module parses a preset blacklist file to obtain the blacklist. The intrusion detection module generates the XDP blacklist program for the blacklist and writes the XDP blacklist program carrying the blacklist into the XDP network hook.

8. The method according to claim 7, characterized in that, After writing the XDP blacklist-carrying program to the XDP network hook, the method further includes: The intrusion detection module identifies several abnormal traffic flows based on historical detection results over a specified time period and generates a blacklist for these abnormal traffic flows. The intrusion detection module sends the generated blacklist to the XDP blacklist program.

9. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; The processor is configured to execute the intrusion detection method according to any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to perform the intrusion detection method according to any one of claims 1-8.

Images