A method and system for rapid detection of ICMP tunneling attack intent

Abstract

The application discloses an ICMP tunnel attack intention rapid detection method and system, and the method comprises the following steps: acquiring ICMP flow data, filtering normal ICMP data packets from the ICMP flow data, and reserving abnormal ICMP data packets; grouping the abnormal ICMP data packets according to the source IP and the target IP, wherein the same group comprises the same source IP and the same target IP; pre-configuring flow behavior characteristic standards, and statistically recording the flow behavior characteristics of the ICMP data packets in each group; pre-configuring ICMP tunnel judgment rules of different flow behavior characteristic combinations, comparing all the flow behavior characteristics of the ICMP data packets in each group with the pre-configured ICMP tunnel judgment rules, and outputting the ICMP data packets satisfying the ICMP tunnel judgment rules; extracting characteristic words from the ICMP data packets satisfying the ICMP tunnel judgment rules, and matching the characteristic words with a characteristic word library to obtain an attack type.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an ICMP tunnel attack intention rapid detection method and system BACKGROUND

[0002] At present, in the enterprise intranet environment, ICMP protocol is one of the indispensable network communication protocols, which is usually used to detect whether the network is connected. Generally, most website communication and boundary devices will not filter ICMP traffic. Due to the opening of the firewall to the ICMP protocol, malicious attackers will use ICMP protocol for illegal communication in the case that other communication conditions are not available. For example, in the process of hacking, the hacker has obtained the authority of a host by a certain way, and obtained some files or password files, etc., which need to be returned to the local for cracking or analysis. However, the firewall blocks the request initiated by the intranet, and only the ICMP protocol is not blocked, and the hacker needs to return the file. At this time, the hacker can try to establish an ICMP tunnel (ICMP tunnel is to encapsulate traffic in a ping data packet), and use the ping data packet to penetrate the firewall detection.

[0003] At present, there are many mainstream ICMP tunnel tools, such as ICMPtunnel, Ptunnel, icmpsh, icmpshell, etc. However, since the ICMP tunnel is a network attack method of encapsulating other protocol data packets, malicious commands and malicious data in the data part of the ICMP protocol for transmission, it is more concealed and difficult to detect. Therefore, the detection tools in the prior art have the problems of high false alarm rate and low detection efficiency. SUMMARY

[0004] One of the purposes of the present application is to provide an ICMP tunnel attack intention rapid detection method and system. The method and system filter normal ICMP data packets, group non-normal ICMP data packets according to source IP and destination IP, and quickly detect whether it is an ICMP tunnel behavior according to the statistical behavior of ICMP data packets in the group, so as to quickly locate which network attack behavior it is.

[0005] Another purpose of the present application is to provide an ICMP tunnel attack intention rapid detection method and system. The method and system use the result data packets grouped based on source IP and destination IP to statistically analyze the ICMP traffic behavior characteristics, configure ICMP tunnel judgment rules according to the statistical results, and obtain accurate and comprehensive ICMP tunnel judgment results.

[0006] Another object of the present application is to provide an ICMP tunnel attack intention rapid detection method and system, which further extracts characteristic words of the ICMP tunnel data packet after judging the ICMP tunnel traffic data packet, and compares the characteristic words with a characteristic word library to obtain the type of the ICMP tunnel traffic attack.

[0007] Another object of the present application is to provide an ICMP tunnel attack intention rapid detection method and system, which directly performs statistical analysis on ICMP traffic behavior characteristics without training and judging by means of other complex large network models, so that the program setting overhead is small, the detection time is short, the ICMP tunnel judgment accuracy is high based on the multi-behavior characteristic combination judgment, and the technical effects of high performance and low false alarm are achieved.

[0008] In order to achieve at least one of the above-mentioned objects, the present application further provides an ICMP tunnel attack intention rapid detection method, which comprises:

[0009] ICMP traffic data is acquired, normal ICMP data packets are filtered out from the ICMP traffic data, and abnormal ICMP data packets are reserved;

[0010] The abnormal ICMP data packets are grouped according to their own source IP and target IP, and the same group includes the same source IP to the same target IP;

[0011] Traffic behavior characteristic standards are pre-configured, and traffic behavior characteristics of ICMP data packets in each group are counted;

[0012] ICMP tunnel judgment rules of different traffic behavior characteristic combinations are pre-configured, all traffic behavior characteristics in each group of ICMP data packets are compared with the pre-configured ICMP tunnel judgment rules, and ICMP data packets satisfying the ICMP tunnel judgment rules are output;

[0013] Characteristic words are extracted from the ICMP data packets satisfying the ICMP tunnel judgment rules, and the intention attack type is obtained by matching the characteristic words with a characteristic word library.

[0014] According to one preferred embodiment of the present application, the normal ICMP data packet filtering method comprises: after acquiring the ICMP traffic data, 16-bit data of ping data packets in the ICMP traffic data is divided into 4-bit size comparison characteristic arrays, the comparison characteristic arrays are matched with normal ICMP traffic characteristic arrays, the matching degree is calculated, a matching degree threshold is set, and ICMP data packets greater than the matching degree threshold are regarded as normal ICMP data packets.

[0015] According to another preferred embodiment of the present application, the matching degree calculation method comprises: obtaining the length of the ICMP packet payload, obtaining the matched comparison feature array, and matching degree = matched comparison feature array * 4 / ICMP packet payload length.

[0016] According to another preferred embodiment of the present application, the traffic behavior feature statistics of the abnormal ICMP packet comprises: counting the number of ICMP packets in each group after grouping; counting the number of ICMP packets with abnormal payload length in each group; counting the number of ICMP packets with abnormal payload content in each group; counting the number of ICMP packets with non-repeated payload content in each group; counting the number of abnormal type in each group of ICMP packets; and counting whether the request-response is consistent in each group of ICMP packets.

[0017] According to another preferred embodiment of the present application, the ICMP tunnel judgment rule configured according to all the statistical traffic behavior features comprises: if the request-response of the ICMP packets in the current group is inconsistent, the number of abnormal type in the current group of ICMP packets exceeds the preset threshold, and the number of ICMP packets with non-repeated payload content in the current group is greater than the number of request packets, it is determined that the current detected packet is ICMP tunnel traffic.

[0018] According to another preferred embodiment of the present application, the ICMP tunnel judgment rule configured according to all the statistical traffic behavior features comprises: if the request-response of the ICMP packets in the current group is inconsistent, the number of ICMP packets with non-repeated payload content in the current group is greater than the number of request packets, and the number of ICMP packets with abnormal payload length in the current group is equal to the number of ICMP packets with non-repeated payload content in the current group, it is determined that the current detected packet is ICMP tunnel traffic.

[0019] According to another preferred embodiment of the present application, the ICMP tunnel judgment rule configured according to all the statistical traffic behavior features comprises: the number of ICMP packets with non-repeated payload content in the current group is greater than the number of request packets, the number of ICMP packets with non-repeated payload content in the current group is greater than the number of response packets, the number of ICMP packets in the current group is greater than the preset threshold, and the number of ICMP packets with abnormal payload length in the current group is the preset threshold, then the current detected packet is ICMP tunnel traffic.

[0020] According to another preferred embodiment of the present application, after all the statistical traffic behavior features are configured, it is further determined that the traffic is normal according to any one of the following traffic behavior features: the lengths of the ICMP packets in the current group are counted and the lengths are de-duplicated, if the number of the types of the lengths is less than a specific threshold, it is considered that the group is normal traffic; or the number of the sequence numbers of the ICMP packets in the current group is counted and de-duplicated, if the number of the sequence numbers after de-duplication is 1, it is considered that the group is normal traffic; or the number of the request packets and the response packets in the current group is counted, if all the packets in the current group are request packets without response packets, it is considered that the group is normal traffic.

[0021] In order to achieve at least one of the above-mentioned purposes, the present application further provides an ICMP tunnel attack intention rapid detection system, which executes the ICMP tunnel attack intention rapid detection method.

[0022] The present application further provides a computer readable storage medium, which stores a computer program, and the computer program can execute the ICMP tunnel attack intention rapid detection method by a processor. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 The figure shows a flowchart of the ICMP tunnel attack intention rapid detection method. DETAILED DESCRIPTION

[0024] The following description is provided to enable any person skilled in the art to practice the present application. The preferred embodiments in the following description are only examples of the present application and other obvious modifications are possible to those skilled in the art. The basic principles defined in the following description can be applied to other embodiments, modifications, improvements, equivalents and other technical solutions without departing from the spirit and scope of the present application.

[0025] It can be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of one element can be one, and in another embodiment, the number of the element can be multiple, and the term "one" cannot be understood as a limitation on the number.

[0026] Please refer to Figure 1The embodiment discloses an ICMP tunnel rapid detection method and system based on statistical behavior characteristics, and mainly comprises the following steps: firstly, mirroring the traffic, and using an existing protocol analysis engine to analyze ICMP traffic as original data from the mirrored traffic. After obtaining the ICMP traffic, preprocessing the ICMP traffic, and including filtering normal traffic data and abnormal traffic data from the ICMP traffic data, grouping the abnormal traffic, further statistically analyzing the traffic behavior characteristics in the abnormal traffic data, comparing each group of ICMP traffic with the ICMP tunnel judgment rule based on different traffic behavior characteristics, if the ICMP tunnel judgment rule is met, the ICMP traffic can be determined as ICMP tunnel, and further extracting the feature words in the ICMP tunnel data, comparing the extracted feature words with the feature word library, and obtaining the intent attack type of the ICMP traffic according to the comparison result.

[0027] Specifically, the ICMP traffic original data is preprocessed, and the preprocessing method comprises the following steps: after obtaining the ICMP traffic original data, filtering the normal ping data packet according to the payload part in the ICMP traffic original data, taking the filtered abnormal ICMP data packet as the detection data, and it should be noted that, since the 16-bit part of the data field of the normal ICMP data packet has a certain regularity, and the 16-bit part of the ICMP tunnel has no regularity and is a random sequence part, therefore, the normal ICMP data packet and the abnormal ICMP data packet can be obtained by cutting the ICMP data packet according to the above-mentioned regularity and calculating the matching degree, so as to complete the filtering of the normal ICMP data packet. The matching calculation method comprises the following steps: cutting the 16-bit part of the data field of the ICMP data packet into a feature array of 4 bits, further calculating the matching degree according to the feature array and the payload, wherein the matching degree = the number of matched features * 4 / payload length, setting the matching degree threshold, taking the ICMP data packet with a matching degree higher than the matching degree threshold as the normal data packet, and filtering the ICMP data packet with a matching degree higher than the matching degree threshold. It should be noted that, the feature matching method comprises the following steps: firstly, dividing the data field in Linux and win into a feature array of 4 bits according to the 16-bit, and secondly, dividing the 16-bit of the data field of the ICMP data packet to be detected into a feature array of 4 bits, and using the feature array to be detected and the standby feature array of Linux to take the intersection as the matched features.

[0028] Further, the filtered abnormal ICMP data packet is taken as the to-be-detected data, the abnormal ICMP data packet is divided into a group according to the source IP and the target IP, wherein the abnormal ICMP data packets with the same source IP and the same target IP are divided into a group, and the abnormal ICMP data packets in a specific time window are divided into N groups for detection.

[0029] It is worth mentioning that the application needs to further detect the traffic behavior characteristics of each group of abnormal ICMP packets, and count different traffic behavior characteristics of each group, wherein the different traffic behavior characteristics include the following statistical contents: 1, count the total number of ICMP packets in each group; 2, count the number of ICMP packet payload length anomalies (lengths not equal to 48 or 32 are abnormal) in each group; 3, count the number of ICMP packet payload content anomalies in each group; 4, count the number of ICMP packet payload content that does not repeat in each group; 5, count the number of abnormal type in the ICMP packet in each group (abnormal type is not equal to 0 or 8); 6, count whether the request-response of the ICMP packet in each group is consistent; the above six statistical traffic behavior characteristics are all possible characteristics of abnormal packets. The application further configures the judgment rules of ICMP tunnel according to the already counted traffic behavior characteristics, and the application needs to pre-configure three kinds of ICMP tunnel judgment rules, which are: the first judgment rule: if the request-response in the ICMP packet in the current group is inconsistent, and the number of abnormal type in the corresponding ICMP packet exceeds the pre-set threshold, and the number of payload content that does not repeat in the ICMP packet in the current group is greater than the detected request packet number, and the above pre-set judgment rules are satisfied at the same time, the current ICMP packet can be judged as ICMP tunnel behavior. The second judgment rule: if the request-response in the ICMP packet in the current group is inconsistent, and the number of payload content that does not repeat in the ICMP packet in the current group is greater than the detected request packet number, and the number of ICMP packet payload length anomalies in the current group is equal to the number of payload content that does not repeat in the ICMP packet in the current group, and the number of request packets in the current group is greater than the pre-set threshold, and the above traffic behavior characteristic conditions are satisfied at the same time, the current ICMP packet can be judged as ICMP tunnel. The third judgment rule: the number of payload content that does not repeat in the ICMP packet in the current group is greater than the number of request packets, and the number of payload content that does not repeat in the ICMP packet in the current group is greater than the number of response packets, and the number of ICMP packets in the current group is greater than the pre-set threshold, and the number of ICMP packet payload length anomalies in the current group is the pre-set threshold, and the above traffic behavior characteristic conditions are satisfied at the same time, the ICMP packet in the current group is judged as ICMP tunnel. After detecting and counting all the ICMP packets in the above groups, each group of packets is matched with the above set first judgment rule, second judgment rule and third judgment rule in turn. As long as any one of the above judgment rules is satisfied, the ICMP packet in the current group is judged as ICMP tunnel.

[0030] It should be noted that when the traffic behavior characteristics are counted, part of the counted traffic behavior characteristics can be identified as normal ICMP traffic, so as to regard the ICMP data packet of the current group as normal ICMP traffic as long as at least one of the following three traffic behavior characteristics is satisfied: 1. The length of the ICMP data packet in the current group is counted, and the length of the data packet is de-duplicated, if the number of the types of the data packet length is less than a specific threshold, it is considered that the group is normal traffic; 2. The number of ICMP data packet sequence numbers in the current group is counted and de-duplicated, if the number of the sequence numbers after de-duplication is 1, it is considered that the group is normal traffic; 3. The number of request packets and response packets in the current group is counted, if all the packets in the current group are request packets without response packets, it is considered that the group is normal traffic.

[0031] Further, after counting all the traffic behavior characteristics and obtaining the abnormal ICMP tunnel data packet, the feature words in the ICMP tunnel data packet are further extracted, the extracted feature words are matched with the content in the feature word library, and the intention attack type of the current ICMP tunnel is obtained according to the matching result, wherein the feature word library is a pre-constructed matching library, and different intention attack type requires different feature word categories to be stored in the library, wherein the feature word library corresponds to the list of intention attack types, and examples of the feature words and the intention attack types are as follows:

[0032]

[0033] When any feature word example in the extracted feature words of the ICMP tunnel data packet exists in the corresponding feature word library attack type, the corresponding feature word attack type under the feature word example is output.

[0034] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments disclosed herein. For example, embodiments of the disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication section, and / or installed from a detachable medium. When the computer program is executed by a central processing unit (CPU), the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable medium described above in the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, in which a computer readable program code is carried. Such a propagated data signal can take many forms, including but not limited to, an electromagnetic signal, an optical signal or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium that can send, propagate or transfer a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to, wireless, wire, optical cable, RF or the like, or any suitable combination of the above.

[0035] The computer program product of the present application can be a computer program product comprising a computer-readable medium bearing computer program code embodied therein for use with a computer. The computer program code can be code defining and / or implementing the present application. The computer program code can be written in any suitable computer readable programming language. The computer program code can be stored in a computer- readable storage medium, such as, but not limited to, any type of disk including an optical disk, a CD-ROM, a CD-R, a CD-RW, a DVD, a flash memory, a ROM, a RAM, a magnetic disk or hard drive, or any other suitable type of medium including a medium that holds the software for a particular or specialized computing purpose, or any suitable combination of media. The computer program product can be a computer program product distributed to end users, whether as a stand-alone program, as part of a physical system, or as a software download. The computer program product can be distributed on a physical medium, such as, but not limited to, a floppy disk, a CD-ROM, a CD-R, a CD-RW, a DVD, a flash memory, a ROM, a RAM, a magnetic disk or hard drive, or any other suitable type of medium, or any suitable combination of media. The computer program product can be distributed from a program distribution center, either as a tangible medium or via electronic delivery, such as from a Web site via the Internet, or from one computer to another via electronic transfer, such as by e-mail. The computer program product can be distributed in an encrypted manner, such as via encryption or via password protection.

[0036] Those skilled in the art will understand that the application described above and illustrated in the accompanying drawings is presented by way of example only and is not limiting as to the present application. The intent is to cover all modifications and alternatives of the present application falling within the scope of the application.

Claims

1. A method for rapid detection of ICMP tunneling attack intention, characterized in that, The method comprises: Obtaining ICMP traffic data, filtering out normal ICMP data packets, and retaining abnormal ICMP data packets; Grouping the abnormal ICMP data packets according to source IP and target IP, and including the same source IP to the same target IP in the same group; Pre-configuring traffic behavior feature standards, and performing traffic behavior feature statistics on ICMP data packets in each group, wherein when traffic behavior statistics satisfy at least one of the following three traffic behavior features, the ICMP data packets in the current group are normal ICMP traffic: first, the lengths of ICMP data packets in the current group are counted, and the lengths of the data packets are de-duplicated, if the number of types of the lengths of the data packets is less than a specific threshold, the group is considered as normal traffic; second, the number of sequence numbers of ICMP data packets in the current group is counted and de-duplicated, if the number of sequence numbers after de-duplication is 1, the group is considered as normal traffic; third, the number of request packets and response packets in the current group is counted, if all the packets in the current group are request packets without response packets, the group is considered as normal traffic; Pre-configuring ICMP tunnel judgment rules of different traffic behavior feature combinations, comparing all traffic behavior features in each group of ICMP data packets with the pre-configured ICMP tunnel judgment rules, and outputting ICMP data packets satisfying the ICMP tunnel judgment rules, wherein the ICMP tunnel judgment rules are obtained by performing traffic behavior feature statistics on abnormal ICMP data packets, and the traffic behavior feature statistics on abnormal ICMP data packets comprises: counting the number of ICMP data packets in each group after grouping; counting the number of abnormal payload length of ICMP data packets in each group; counting the number of abnormal payload content of ICMP data packets in each group; counting the number of non-repeated payload content of ICMP data packets in each group; counting the number of abnormal type of ICMP data packets in each group; and counting whether the request-response of ICMP data packets in each group is consistent; Extracting feature words from the ICMP data packets satisfying the ICMP tunnel judgment rules, and matching the feature words with a feature word library to obtain an intent attack type. 2.The method of claim 1, wherein, The normal ICMP data packet filtering method comprises: after obtaining the ICMP traffic data, cutting the 16-bit data of ping data packets in the ICMP traffic data into 4-bit size comparison feature arrays, matching the comparison feature arrays with normal ICMP traffic feature arrays, calculating a matching degree, setting a matching degree threshold, and taking ICMP data packets with a matching degree greater than the matching degree threshold as normal ICMP data packets. 3.The method of claim 2, wherein, The matching degree calculation method comprises: obtaining the payload length of ICMP data packets, obtaining matched comparison feature arrays, and calculating a matching degree = matched comparison feature arrays * 4 / ICMP data packet payload length.

4. The method of claim 1, wherein the method further comprises: The ICMP tunnel judgment rule configured according to all the statistical traffic behavior characteristics comprises: if the current group of ICMP data packets is inconsistent in request response, the number of abnormal types in the current group of ICMP data packets exceeds the preset threshold, and the number of payload contents that are not repeated in the current group of ICMP data packets is greater than the number of request data packets, it is determined that the current detection data packet is ICMP tunnel traffic.

5. The method of claim 1, wherein the method further comprises: The ICMP tunnel judgment rule configured according to all the statistical traffic behavior characteristics comprises: if the current group of ICMP data packets is inconsistent in request response, the number of payload contents that are not repeated in the current group of ICMP data packets is greater than the number of request data packets, and the number of payload length abnormalities in the current ICMP data packet is equal to the number of payload contents that are not repeated in the current group of ICMP data packets, it is determined that the current detection data packet is ICMP tunnel traffic.

6. The method of claim 1, wherein the method further comprises: The ICMP tunnel judgment rule configured according to all the statistical traffic behavior characteristics comprises: the number of payload contents that are not repeated in the current group of ICMP data packets is greater than the number of request data packets, the number of payload contents that are not repeated in the current group of ICMP data packets is greater than the number of response data packets, the number of ICMP data packets in the current group is greater than the preset threshold, and the number of payload length abnormalities in the current group of ICMP data packets is the preset threshold, so the current detection data packet is ICMP tunnel traffic.

7. The method for fast detection of ICMP tunneling attack intention according to claim 1, characterized in that, After obtaining all the statistical traffic behavior characteristics configurations, it is further determined as normal traffic according to any one of the following traffic behavior characteristics: the lengths of the ICMP data packets in the current group are counted, and the packet lengths are de-duplicated, if the number of packet length categories is less than a specific threshold, it is considered that the group is normal traffic; or the number of sequence numbers of the ICMP data packets in the current group is counted and de-duplicated, if the number of sequence numbers after de-duplication is 1, it is considered that the group is normal traffic; or the number of request packets and response packets in the current group is counted, if all the packets in the current group are request packets without response packets, it is considered that the group is normal traffic.

8. An ICMP tunneling attack intent rapid detection system, characterized in that, The system performs the ICMP tunnel attack intent rapid detection method of any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program can be executed by the processor to perform the ICMP tunnel attack intent rapid detection method of any one of claims 1-7.

Images