Attack detection method, device, equipment and readable storage medium

Abstract

The application provides an attack detection method, device and equipment and a readable storage medium. The method comprises: obtaining a data packet of a preset type in a network, and determining a data stream corresponding to the data packet; storing a to-be-tested data packet in the data packet in a cache area of the data stream according to a sequence number order; in response to a data packet sequence in the cache area meeting a set sequence number requirement, matching a payload of a to-be-tested data packet sequence in the data packet sequence with a feature node of a feature dictionary tree, the feature dictionary tree being constructed according to a feature string corresponding to an attack behavior and an AC automatic machine algorithm; and in the case that the payload and the feature node match successfully, determining that a data packet corresponding to the payload is an attack data packet. The technical solution provided by the application reduces the system overhead of attack detection and improves the detection efficiency.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to an attack detection method, apparatus, device, and readable storage medium. Background Technology

[0002] Stream fragmentation stealth attack is a common attack method. Specifically, attackers divide attack packets into multiple small fragment packets, so that each fragment packet does not contain complete attack characteristics. During the transmission of fragment packets, out-of-order, redundant, and overlapping packets are used to evade detection by network protection devices and achieve the attack objective.

[0003] Traditional network protection devices deal with attacks that evade intrusion detection by fragmenting streams by reconstructing attack packets and then detecting the attack behavior. However, this method has a high system overhead. Summary of the Invention

[0004] In view of this, in order to solve the above-mentioned technical problems, this application provides an attack detection method, apparatus, device and readable storage medium.

[0005] Specifically, this application is implemented through the following technical solution:

[0006] According to a first aspect of the embodiments of this application, an attack detection method is provided, the method comprising:

[0007] Acquire data packets of a preset type in the network and determine the data stream corresponding to the data packets;

[0008] The test data packets that meet the set requirements in the data packets are stored in the buffer area of ​​the data stream in sequence according to their sequence numbers;

[0009] In response to the data packet sequence in the buffer meeting the set sequence number requirement, the payload of the data packet sequence to be tested in the data packet sequence is matched with the feature nodes of the feature dictionary tree, which is constructed based on the feature strings corresponding to the attack behavior and the AC automaton algorithm;

[0010] If the payload and the feature node are successfully matched, the data packet corresponding to the payload is determined to be an attack data packet.

[0011] Optionally, the preset type includes the Transmission Control Protocol (TCP) type.

[0012] Optionally, the method further includes:

[0013] If there is no corresponding buffer for the data stream corresponding to the data packet, a buffer is allocated for the data stream, and the most recently matched feature node associated with the data stream includes the root node of the feature trie.

[0014] Optionally, storing the test data packets that meet the set requirements in the data packet into the buffer of the data stream according to their sequence numbers includes:

[0015] Based on the sequence number and data length of the data packet, the data packet is compared with the data packet sequence in the buffer of the data stream corresponding to the data packet;

[0016] If the sequence number between the sequence number and the acknowledgment number of the data packet does not exist in the sequence number sequence corresponding to the data packet sequence, it is determined that the data packet meets the set requirements. The acknowledgment number includes the sum of the sequence number of the data packet and the data length.

[0017] Optionally, the set sequence number requirement includes the sequence number of one data packet and the data length of the other data packet, which are equal to the sequence number of the other data packet in every two adjacent data packets.

[0018] Optionally, the step of matching the payload of the test data packet sequence in the data packet sequence with the feature nodes of the feature trie in response to the data packet sequence in the buffer meeting the set sequence number requirement includes:

[0019] Obtain the most recently matched feature node associated with the data stream;

[0020] Based on the sequence number order of the data packet sequence to be tested, starting from the most recently matched feature node, the payload of the data packet sequence to be tested is matched with the feature nodes of the feature dictionary tree;

[0021] After the test data packet sequence is matched with the feature dictionary, the last successfully matched feature node of the test data packet sequence and the feature dictionary is determined, and the most recently successfully matched feature node associated with the data stream is updated to the last successfully matched feature node.

[0022] Optionally, the method further includes:

[0023] In response to a situation where the sequence of data packets in the buffer does not meet the set sequence number requirement and the sequence of data packets in the buffer exceeds the memory limit, the data packets in the buffer are deleted.

[0024] According to a second aspect of the embodiments of this application, an attack detection apparatus is provided, the apparatus comprising:

[0025] The data packet acquisition module is used to acquire data packets of a preset type in the network and determine the data stream corresponding to the data packets;

[0026] A data packet caching module is used to store test data packets that meet the set requirements in the data packet into the buffer area of ​​the data stream according to the sequence number;

[0027] The matching module is used to match the payload of the data packet sequence to be tested in the data packet sequence with the feature nodes of the feature dictionary tree in response to the data packet sequence in the buffer meeting the set sequence number requirement. The feature dictionary tree is constructed based on the feature strings corresponding to the attack behavior and the AC automaton algorithm.

[0028] The result determination module is used to determine that the data packet corresponding to the payload is an attack data packet when the payload and the feature node are successfully matched.

[0029] Optionally, the preset type includes the Transmission Control Protocol (TCP) type.

[0030] Optionally, the device further includes:

[0031] The cache allocation module is used to allocate a cache area for the data stream when there is no corresponding cache area for the data stream corresponding to the data packet. The most recently matched feature node associated with the data stream includes the root node of the feature trie.

[0032] Optionally, the data packet caching module is specifically used for:

[0033] Based on the sequence number and data length of the data packet, the data packet is compared with the data packet sequence in the buffer of the data stream corresponding to the data packet;

[0034] If the sequence number between the sequence number and the acknowledgment number of the data packet does not exist in the sequence number sequence corresponding to the data packet sequence, it is determined that the data packet meets the set requirements. The acknowledgment number includes the sum of the sequence number of the data packet and the data length.

[0035] Optionally, the set sequence number requirement includes the sequence number of one data packet and the data length of the other data packet, which are equal to the sequence number of the other data packet in every two adjacent data packets.

[0036] Optionally, the matching module is specifically used for:

[0037] Obtain the most recently matched feature node associated with the data stream;

[0038] Based on the sequence number order of the data packet sequence to be tested, starting from the most recently matched feature node, the payload of the data packet sequence to be tested is matched with the feature nodes of the feature dictionary tree;

[0039] After the test data packet sequence is matched with the feature dictionary, the last successfully matched feature node of the test data packet sequence and the feature dictionary is determined, and the most recently successfully matched feature node associated with the data stream is updated to the last successfully matched feature node.

[0040] Optionally, the device further includes:

[0041] The cache deletion module is used to delete data packets in the cache area when the data packet sequence in the cache area does not meet the set sequence number requirement and the data packet sequence in the cache area exceeds the memory limit.

[0042] According to a third aspect of the embodiments of this application, an electronic device is provided, the electronic device comprising: a memory and a processor; the memory being used to store a computer program; the processor being used to execute the above-described attack detection method by invoking the computer program.

[0043] According to a fifth aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, wherein the program, when executed by a processor, implements the above-described attack detection method.

[0044] The technical solutions provided in this application embodiment may include the following beneficial effects:

[0045] In the technical solution provided in this application, the payload of the test data packet sequence that meets the set sequence number requirement in the buffer of the data stream is matched with the feature nodes of the feature dictionary tree to detect whether the test data packet is an attack data packet. It is not necessary to obtain all the fragment data packets corresponding to the attack data packet and then detect each fragment data packet in turn, which reduces the system overhead of attack detection and improves detection efficiency.

[0046] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application. Furthermore, no embodiment in this application needs to achieve all the effects described above. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0048] Figure 1 This is a schematic diagram of an attack detection method illustrated in an exemplary embodiment of this application;

[0049] Figure 2 This is a schematic diagram illustrating an attack detection method based on TCP stream fragmentation data packets, as shown in an exemplary embodiment of this application;

[0050] Figure 3 This is a flowchart illustrating an exemplary embodiment of a TCP stream fragmentation packet attack detection method based on an intrusion detection system.

[0051] Figure 4 This is a schematic diagram of the structure of an attack detection device shown in an exemplary embodiment of this application;

[0052] Figure 5 This is a hardware schematic diagram of an electronic device illustrated in an exemplary embodiment of this application. Detailed Implementation

[0053] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0054] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0055] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, a first classification threshold may also be referred to as a second classification threshold, and similarly, a second classification threshold may also be referred to as a first classification threshold. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0056] Attack evasion technology is a deliberate, stealthy attack technique. Specifically, when an attacker discovers that the target is protected by network protection devices such as intrusion detection systems (IPS), the attacker adjusts the attack method or content based on the target's protocol characteristics or vulnerabilities, thereby evading detection by the network protection devices.

[0057] Stream fragmentation stealth attacks are network attack methods that utilize attack evasion techniques. Attackers divide attack packets into multiple small fragments, ensuring that each fragment does not contain complete attack characteristics. During transmission, these fragments are supplemented with out-of-order, redundant, and overlapping packets to evade detection by network protection devices and achieve the attack objective. For example, a TCP stream attack packet might have attack characteristics "...cart...hers...". An attacker might divide it into attack packet 1 "...ca", attack packet 2 "rt...h", and attack packet 3 "ers...", and during transmission, it might be sent in the order of attack packet 1, attack packet 3, and attack packet 2.

[0058] Traditional network protection devices counter attacks that evade intrusion detection through flow fragmentation by reconstructing attack packets and then detecting the attack behavior. However, when the number of fragments in each attack packet is too large, the system overhead of flow reconstructing the fragmented attack packets is significant, and it may even cause the flow reconstructing method to fail. Taking the TCP flow attack packet as an example, flow reconstructing reassembles the three received fragmented packets in sequence number order, i.e., attack packet 1, attack packet 2, and attack packet 3, and then detects the reconstructed packet. When the number of packet fragments is too large, in the event of packet loss, the flow reconstructing operation can only be completed after all the lost packets have been received, resulting in significant system overhead.

[0059] To address the aforementioned problems, this application provides an attack detection method, such as... Figure 1 As shown, the method may include:

[0060] S101, Obtain data packets of a preset type in the network, and determine the data stream corresponding to the data packets;

[0061] The data packets may include preset types of data packets on the links through which the traffic of interest must flow, and can be obtained by attaching an intrusion detection system (IDS) to the links through which the traffic of interest must flow.

[0062] The data stream is a one-way message stream transmitted between a source IP address and a destination IP address over a period of time. These one-way messages share the same source port number, destination port number, protocol number, source IP address, and destination IP address—that is, they have identical 5-tuple information. Therefore, based on the 5-tuple information of the data packets, the data stream corresponding to the data packets can be determined.

[0063] In some embodiments, the preset type may include the Transmission Control Protocol (TCP) type. Correspondingly, TCP packets in the network can be acquired, and the corresponding data stream can be determined based on the five-tuple information of the TCP packets.

[0064] S102, the test data packets that meet the set requirements in the data packets are stored in the buffer of the data stream in sequence according to their sequence numbers;

[0065] After obtaining a data packet of a preset type, it can be determined whether the data packet meets the preset requirements according to the set rules; if the data packet meets the preset requirements, the data packet is determined to be a data packet to be tested, and the data packet is stored in the buffer of the data stream.

[0066] The buffer of the data stream is used to store the data packets transmitted by the stream, that is, to store data packets with the same five-tuple information. In this buffer, the data packets are arranged sequentially according to their sequence numbers.

[0067] When storing the data packet to be tested in the buffer of the data stream, if there is no data packet currently stored in the buffer, the data packet to be tested is directly stored in the buffer; if the buffer has already stored data packets, the data packet to be tested needs to be compared with the sequence number of the data packets already stored in the buffer, and the storage location of the data packet to be tested in the buffer is determined according to the sequence number in ascending order.

[0068] S103, in response to the data packet sequence in the buffer meeting the set sequence number requirement, the payload of the data packet sequence to be tested in the data packet sequence is matched with the feature nodes of the feature dictionary tree, which is constructed based on the feature string corresponding to the attack behavior and the AC automaton algorithm;

[0069] The set sequence number requirement may include the sequence number and data length of one data packet in every two adjacent data packets being equal to the sequence number of the other data packet.

[0070] After storing the data packet to be tested in the buffer, every two adjacent data packets in the data packet sequence can be obtained, and it can be determined whether the sum of the sequence number of the data packet with the smaller sequence number and its corresponding data length is equal to the sequence number of the data packet with the larger sequence number. If the determination result of the sequence number of every two adjacent data packets is yes, it is determined that the data packet sequence meets the set sequence number requirement.

[0071] When the data packet sequence meets the set sequence number requirement, the payload of the data packet sequence under test is matched with the feature nodes of the feature dictionary tree according to the sequence number order of the data packet sequence under test. The payload may include the data field content contained in each data packet in the data packet sequence under test; the feature dictionary tree can be constructed by using the AC automatic calculation method to generate a corresponding dictionary tree from attack feature strings corresponding to various attack behaviors.

[0072] The Aho-Corasick automaton algorithm, or AC automatic calculation algorithm for short, is a string search algorithm used to match substrings from a finite set of "dictionaries" within an input string, simultaneously matching all substrings. The algorithm has an amortized time complexity that is approximately linear, roughly the length of the string plus the number of matches. However, since it needs to find all matches, if every substring matches itself, the algorithm's time complexity will approximate a quadratic function of the matching time, such as when the dictionary is a, aa, aaa, aaaa, and the input string is aaaa. This algorithm primarily relies on constructing a finite state machine, similar to adding mismatch pointers to a trie tree. These extra mismatch pointers allow for backtracking when a string search fails, turning to other branches of a prefix to avoid repeatedly matching prefixes and improving algorithm efficiency. For example, if the word "cat" fails to match in the trie tree, but another word "cart" exists in the trie tree, the mismatch pointer will point to the prefix "ca".

[0073] In some embodiments, the feature trie can be calculated offline based on the attack feature string and stored for future use.

[0074] S104, if the payload and the feature node are successfully matched, the data packet corresponding to the payload is determined to be an attack data packet.

[0075] For example, the sequence of data packets to be tested includes payload A, payload B, and payload C. When payload B successfully matches a feature node, the data packet corresponding to payload B is identified as an attack data packet.

[0076] After the payload of each data packet in the test data packet sequence has been matched with the feature trie, the other data packets in the data stream buffer, except for the last data packet in the test data packet sequence, can be deleted. For example, if the above data packet sequence contains payload A, payload B, and payload C, the data packets corresponding to payload A and payload B in the buffer can be deleted after payload C has been matched with the feature node.

[0077] In the technical solution provided in this application, the payload of the test data packet sequence that meets the set sequence number requirement in the buffer of the data stream is matched with the feature nodes of the feature dictionary tree to detect whether the test data packet is an attack data packet. It is not necessary to obtain all the fragment data packets corresponding to the attack data packet and then detect each fragment data packet in turn, which reduces the system overhead of attack detection and improves detection efficiency.

[0078] In some embodiments, after determining the stream corresponding to the data packet, the method may further include: if the data stream corresponding to the data packet does not have a corresponding buffer, allocating a buffer for the data stream, wherein the most recently matched feature node associated with the data stream includes the root node of the feature trie.

[0079] The corresponding data stream can be determined based on the 5-tuple information of the data packet. If no buffer exists for the data stream, a buffer can be allocated in memory. The most recently matched feature node associated with the data stream can include the feature node that was last successfully matched between the data stream and the feature dictionary. Allocating a buffer in memory for the data stream indicates that the data stream has not been matched with the feature dictionary. Since matching needs to start from the root node of the feature dictionary after the data packet is obtained, the most recently matched feature node associated with the data stream can be set to include the root node of the feature dictionary.

[0080] In some embodiments, storing the test data packets that meet the set requirements in the data packet into the buffer of the data stream according to their sequence numbers may include:

[0081] Based on the sequence number and data length of the data packet, the data packet is compared with the data packet sequence in the buffer of the data stream corresponding to the data packet;

[0082] If the sequence number between the sequence number and the acknowledgment number of the data packet does not exist in the sequence number sequence corresponding to the data packet sequence, it is determined that the data packet meets the set requirements. The acknowledgment number includes the sum of the sequence number of the data packet and the data length.

[0083] For example, if a data packet of a preset type is obtained, the data stream corresponding to the data packet is determined to be data stream 1; if the sequence numbers corresponding to the data packet sequences already stored in the buffer of data stream 1 are 100-199, 200-299, and 400-499, that is, 3 data packets have been stored, and if the sequence number between the sequence number and the acknowledgment number of the data packet of the preset type does not overlap with the sequence numbers of the 3 data packets, such as the sequence number corresponding to the data packet of the preset type including 300-399 or 500-550, it is determined that the data packet meets the set requirements.

[0084] In this embodiment of the disclosure, test data packets that meet the set requirements are stored in the buffer of the data stream. Whether the data packets meet the set requirements is determined by the sequence number and the length of the data field. The header information of the data packets is used to quickly filter and determine the data packets, which improves the processing efficiency. In addition, storing data packets that meet the set requirements solves the problem of using out-of-order, redundant, and overlapping data packets to confuse network protection devices and evade detection in stream fragmentation attacks, thereby enhancing the attack detection capability.

[0085] In some embodiments, the setting requirement includes that the data packet type is out-of-order data packet; before storing the test data packets that meet the setting requirement in the data packet into the buffer of the data stream in sequence number order, it may include: matching the data field of the data packet of the preset type with the data packets in the buffer of the data stream to identify the type of data packet.

[0086] The data packets can be of various types, including out-of-order data packets, redundant data packets, and overlapping data packets. A data packet can be identified as out-of-order by recognizing that it is not redundant or overlapping. Out-of-order data packets can include data packets that arrive out of order according to the data stream sequence number. Redundant data packets can include data packets whose sequence number and data field length are exactly the same as those in the data stream's buffer. Overlapping data packets can include data packets that overlap with those in the data stream's buffer.

[0087] For example, the data stream buffer already stores the sequence number and data field number corresponding to the data packets, including 1000-1199 and 1200-1399. If the sequence number corresponding to the sum of the sequence number and the length of the data field of the acquired data packet is 1000-1199, then the type of the data packet is identified as a redundant data packet; if the sequence number corresponding to the sum of the sequence number and the length of the data field of the acquired data packet is any one of 1100-1188, 1000-1299, 1300-1399, or 1388-1599, then the type of the data packet can be identified as an overlapping data packet.

[0088] In some embodiments, the step of matching the payload of the test data packet sequence in the data packet sequence with the feature nodes of the feature trie in response to the data packet sequence in the buffer meeting the set sequence number requirement may include:

[0089] Obtain the most recently matched feature node associated with the data stream;

[0090] Based on the sequence number order of the data packet sequence to be tested, starting from the most recently matched feature node, the payload of the data packet sequence to be tested is matched with the feature nodes of the feature dictionary tree;

[0091] After the test data packet sequence is matched with the feature dictionary, the last successfully matched feature node of the test data packet sequence and the feature dictionary is determined, and the most recently successfully matched feature node associated with the data stream is updated to the last successfully matched feature node.

[0092] The most recently matched feature node associated with the data stream is the feature node that was most recently matched during the matching process between the data packet corresponding to the data stream and the feature dictionary. When a buffer is allocated to the data stream for the first time, the most recently matched feature node is set as the root node of the feature dictionary; when a buffer already exists for the data stream, the most recently matched feature node is the node corresponding to the last successful match between the payload and the feature node during the previous matching process of the data packet sequence to be tested.

[0093] For example, the previous match for the data stream involved matching the payload "...at" of data packet 1 and the payload "ta..." of data packet 2 with the feature nodes of the feature dictionary in sequence according to their sequence numbers. Data packets 1 and 2 were successfully matched with the branch nodes a→t→t→a on the feature dictionary in sequence. After the payload of data packet 2 was matched with the feature nodes of the feature dictionary, the last successfully matched feature node, i.e., feature node a, was set as the most recently successfully matched feature node associated with the data stream.

[0094] When the data packet sequence in the buffer meets the set sequence number requirement, the most recently matched feature node associated with the data stream is obtained. The test data packet sequence is then matched against the most recently matched feature node corresponding to the feature dictionary, and the payload is matched against the feature nodes sequentially according to the sequence number order of the test data packets. After the last character in the payload of the last data packet in the test data packet sequence is matched, the feature node that was last successfully matched between the test data packet sequence and the feature dictionary is taken as the most recently matched feature node, and the most recently matched feature node associated with the data stream is updated.

[0095] Taking the most recently matched feature node 'a' associated with the aforementioned data stream as an example, the sequence of data packets to be tested in the buffer includes data packets 3, 4, and 5. Following the sequence number order of the data packets, the payload of data packet 3 is matched with the branch nodes of feature node 'a'. If data packet 3 includes the attack feature "ck", it can be matched sequentially with the branch nodes of feature node 'a' according to the character order of the payload, and the matching is successful from c to k. The payload of data packet 4 is then matched with feature node k, and the matching is successful sequentially according to the trie matching principle corresponding to the AC automaton algorithm. If data packets 4 and 5 do not contain the attack feature, then the last successfully matched feature node in the sequence of data packets to be tested is feature node k, and feature node k is set as the most recently matched feature node associated with the data stream.

[0096] In this embodiment of the disclosure, the payload of the data packet sequence to be tested is matched with the most recently matched feature node associated with the data stream in the feature dictionary tree, and the most recently matched feature node associated with the data stream is updated according to the matching result. It is not necessary to detect each fragment data packet sequentially after obtaining all fragment data packets corresponding to the attack data packet, and the matching of each data packet sequence to be tested starts from the most recently matched feature node, which reduces the system overhead of attack detection.

[0097] In some embodiments, after storing the test data packets that meet the set requirements in the data packets into the buffer of the data stream in sequence according to their sequence numbers, the method may further include: deleting the data packets in the buffer in response to the data packet sequence in the buffer not meeting the set sequence number requirements and the data packet sequence in the buffer exceeding the memory limit.

[0098] The data stream buffer is the available space. When there are too many stored data packets, some of them need to be cleaned up. Data packets deleted from the buffer can include those already matched with the feature dictionary, or data packets that have met the aging time but whose sequence numbers do not meet the set requirements.

[0099] For example, the sequence numbers of data packets in the data stream's buffer include 1000-1999, 2000-2999, 4000-4999, 6000-6666, etc. Because data packets with sequence numbers of 3000-3999 and 5000-5999 are missing, the buffer's data packet sequence does not meet the set sequence number requirements. When the buffer exceeds memory limits, data packets with sequence numbers of 1000-1999 can be deleted first. If further data packet deletion is needed, the remaining data packets can be deleted sequentially, selecting those that meet the aging time requirement.

[0100] In one example, if the time for which a data packet sequence in the buffer does not meet the set sequence number requirement exceeds a set time threshold, all data packet sequences in the buffer are discarded, and the data packet sequences are deemed invalid.

[0101] In this embodiment of the disclosure, by setting rules to clear data packets in the cache area, excessive memory consumption can be avoided and processing efficiency can be improved.

[0102] The following section describes the solution proposed in this application, using a specific application scenario for device attack detection. TCP is the network transmission control protocol. The sender sends data packets sequentially according to the acknowledgment number and the size of the sending window. The order in which the data packets arrive at the receiver may differ from the sending order. The receiver reassembles the out-of-order data packets based on their sequence numbers to obtain ordered data packets. A common attack method based on the TCP protocol is TCP stream fragmentation, which divides a TCP data packet containing complete attack characteristics into multiple smaller fragmented data packets. These fragmented data packets contain incomplete attack characteristics.

[0103] This application uses TCP stream fragmentation-based packet attack detection as an example to illustrate the solution of this application in detail. See also... Figure 2 As shown, attack detection methods for TCP stream fragmentation packets can include:

[0104] S201, Obtain TCP stream fragmented data packets, and determine the data stream based on the five-tuple information of the data packets;

[0105] Regarding the acquisition of TCP stream fragmented data packets, a set number of TCP stream fragmented data packets can be acquired each time. The set number includes an integer greater than or equal to 1, and can be set according to the actual processing situation. This application takes the acquisition of one fragmented data packet at a time as an example, and the processing procedure for one fragmented data packet is described in subsequent steps; for the acquisition of more than one fragmented data packet at a time, each fragmented data packet can be processed in the order of its sequence number.

[0106] S202, based on the sequence number and data length of the data packet, determine the data field sequence number of the data packet, and compare the data field sequence number with the data field sequence number of the data packet sequence in the buffer of the data stream;

[0107] For example, if the obtained data packet sequence number is 200 and the data length is 100, then the corresponding data field sequence number is 200-299. The corresponding data field sequence number can be obtained from the data packet sequence in the data stream buffer.

[0108] S203, in response to the fact that the sequence number of the data field of the data packet does not have the same sequence number as the sequence number of the data field of the data packet sequence, it is determined that the data packet meets the set requirements, and the data packet is stored in the buffer of the data stream according to the sequence number order;

[0109] For example, if the data field sequence numbers of the data packet sequence stored in the buffer of the data stream include 100-199 and 300-366, then if it is determined that the data packet corresponding to the data field sequence number 200-299 meets the set requirements, the data packet is stored after the data packet corresponding to 100-199 according to the sequence number order. Then, the data field sequence numbers of the data packets after the data packets are stored in the buffer include 100-199, 200-299, and 300-366.

[0110] S204, in response to the data packet sequence in the buffer meeting the set sequence number requirement, the payload of the data packet sequence to be tested in the data packet sequence is matched with the feature node of the feature dictionary tree. The set sequence number requirement includes that the data field sequence number of the data packet sequence is consecutive, and the feature node is the most recently matched feature node associated with the data stream.

[0111] The data packet sequence in the buffer of the data stream includes data packets that have been matched with the feature dictionary and data packets that have not been matched with the feature dictionary.

[0112] In one example, the data stream is associated with the data field sequence number of the last data packet in the previously matched data packet sequence. This data field sequence number is used to record the sequence numbers of data packets that have been matched in the buffer of the data stream. The sequence of data packets to be tested can be determined based on this data field sequence number. For example, if the data field sequence number of the last data packet in the previously matched data packet sequence is 700-900, then the data stream is associated with this data field sequence number, and data packets with a data field sequence number greater than or equal to 901 are identified as the data packets to be tested.

[0113] Taking the above data packet with data field sequence numbers 200-299 and the data field sequence numbers of the buffer data packet sequence including 100-199 and 300-366 as an example, after storing the data packets with data field sequence numbers 200-299 in the buffer in sequence, the data field sequence numbers of the data packets after storage in the buffer include 100-199, 200-299, and 300-366. At this time, the data field sequence numbers are 100-366, that is, the data field sequence numbers are consecutive. Then, the three test data packets in the buffer are matched with the feature nodes of the feature dictionary tree in sequence according to the sequence number order.

[0114] S205, if the payload and the feature node are successfully matched, the data packet corresponding to the payload is determined to be an attack data packet;

[0115] S206, after the test data packet sequence is matched with the feature dictionary, determine the feature node that was last successfully matched between the test data packet sequence and the feature dictionary, and update the most recently successfully matched feature node associated with the data stream to the last successfully matched feature node.

[0116] In the technical solution provided in this application embodiment, the payload of the test data packet sequence that meets the set sequence number requirement in the buffer of the data stream is matched with the feature nodes of the feature dictionary tree to detect whether the test data packet is an attack data packet. It is not necessary to obtain all the fragment data packets corresponding to the attack data packet and then detect each fragment data packet in turn, which reduces the system overhead of attack detection and improves detection efficiency.

[0117] This application provides a TCP stream fragmentation packet attack detection method based on an intrusion detection system, taking the processing of one TCP packet at a time as an example. (See [link to relevant documentation]). Figure 3 As shown, the method may include the following steps:

[0118] Before attack detection, a feature trie is pre-constructed and cached based on the AC automaton algorithm and attack feature strings corresponding to various known attack behaviors, so that it can be directly called during the attack detection process.

[0119] First, obtain TCP fragmented data packets in the network and determine the data flow corresponding to the data packet. This can be done by attaching the intrusion detection system to the link that the traffic of interest must pass through to capture TCP fragmented data packets. Further, determine whether the data flow has a buffer. If the data flow does not have a buffer, allocate a buffer for the data flow and set the most recently matched feature node associated with the data flow as the root node of the feature trie.

[0120] Next, the type of the data packet is determined. If the data packet is not an out-of-order packet, it is discarded, and the next TCP data packet is acquired. If the data packet is an out-of-order packet, it is stored sequentially in the buffer of the data stream according to its sequence number. Further, it is determined whether the data field sequence numbers of the data packet sequences in the buffer of the data stream are consecutive. If the data field sequence numbers of the data packet sequences are not consecutive, the next TCP data packet is acquired. If the data field sequence numbers of the data packet sequences are consecutive, the following steps may be included:

[0121] Obtain the most recently matched feature node associated with the data stream;

[0122] Based on the sequence number of the data packet sequence, starting from the most recently matched feature node, the payload of the data packet sequence to be tested is matched with the feature nodes of the feature dictionary tree. Specifically, it is determined whether the payload contains the feature character corresponding to the feature node. If it does not contain the feature character corresponding to the feature node, the payload fails to match the feature node. If it contains the feature character corresponding to the feature node, the payload matches the feature node successfully, and it is determined that the data packet to be tested corresponding to the payload is an attack data packet.

[0123] Furthermore, it is determined whether all the data packets to be tested in the sequence of data packets to be tested have been matched. If not, the payload of the next data packet to be tested is matched according to the sequence of data packets to be tested. If yes, the most recently matched feature node associated with the data stream is updated, and a new data packet to be tested is obtained.

[0124] For an example corresponding to the aforementioned attack detection method, see [link to example]. Figure 4 As shown, this application also provides an embodiment of an attack detection device, which may include:

[0125] The data packet acquisition module 401 is used to acquire data packets of a preset type in the network and determine the data stream corresponding to the data packets;

[0126] The data packet caching module 402 is used to store the test data packets that meet the set requirements in the data packets into the buffer area of ​​the data stream according to the sequence number order;

[0127] The matching module 403 is used to match the payload of the data packet sequence to be tested in the data packet sequence with the feature nodes of the feature dictionary tree in response to the data packet sequence in the buffer meeting the set sequence number requirement. The feature dictionary tree is constructed based on the feature string corresponding to the attack behavior and the AC automaton algorithm.

[0128] The result determination module 404 is used to determine that the data packet corresponding to the payload is an attack data packet when the payload and the feature node are successfully matched.

[0129] Optionally, the preset type includes the Transmission Control Protocol (TCP) type.

[0130] Optionally, the device further includes:

[0131] The cache allocation module is used to allocate a cache area for the data stream when there is no corresponding cache area for the data stream corresponding to the data packet. The most recently matched feature node associated with the data stream includes the root node of the feature trie.

[0132] Optionally, the data packet caching module is specifically used for:

[0133] Based on the sequence number and data length of the data packet, the data packet is compared with the data packet sequence in the buffer of the data stream corresponding to the data packet;

[0134] If the sequence number between the sequence number and the acknowledgment number of the data packet does not exist in the sequence number sequence corresponding to the data packet sequence, it is determined that the data packet meets the set requirements. The acknowledgment number includes the sum of the sequence number of the data packet and the data length.

[0135] Optionally, the set sequence number requirement includes the sequence number of one data packet and the data length of the other data packet, which are equal to the sequence number of the other data packet in every two adjacent data packets.

[0136] Optionally, the matching module is specifically used for:

[0137] Obtain the most recently matched feature node associated with the data stream;

[0138] Based on the sequence number order of the data packet sequence to be tested, starting from the most recently matched feature node, the payload of the data packet sequence to be tested is matched with the feature nodes of the feature dictionary tree;

[0139] After the test data packet sequence is matched with the feature dictionary, the last successfully matched feature node of the test data packet sequence and the feature dictionary is determined, and the most recently successfully matched feature node associated with the data stream is updated to the last successfully matched feature node.

[0140] Optionally, the device further includes:

[0141] The cache deletion module is used to delete data packets in the cache area when the data packet sequence in the cache area does not meet the set sequence number requirement and the data packet sequence in the cache area exceeds the memory limit.

[0142] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0143] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0144] This application also provides an electronic device, the structural schematic diagram of which is shown below. Figure 5 As shown, the electronic device 500 includes at least one processor 501, a memory 502, and a bus 503. At least one processor 501 is electrically connected to the memory 502. The memory 502 is configured to store at least one computer-executable instruction, and the processor 501 is configured to execute the at least one computer-executable instruction to perform the steps of any attack detection method provided in any embodiment or optional implementation of this application.

[0145] Furthermore, the processor 501 can be an FPGA (Field-Programmable Gate Array) or other devices with logic processing capabilities, such as an MCU (Microcontroller Unit) or a CPU (Central Processing Unit).

[0146] According to the technical solution provided in the embodiments of this application, by matching the payload of the test data packet sequence that meets the set sequence number requirement in the buffer of the data stream with the feature nodes of the feature dictionary tree, it is possible to detect whether the test data packet is an attack data packet. This eliminates the need to obtain all the fragmented data packets corresponding to the attack data packet and then detect each fragmented data packet in turn, thereby reducing the system overhead of attack detection and improving detection efficiency.

[0147] This application also provides another readable storage medium storing a computer program that, when executed by a processor, implements the steps of any attack detection method provided in any embodiment or optional implementation of this application.

[0148] The readable storage media provided in this application include, but are not limited to, any type of disk (including floppy disk, hard disk, optical disk, CD-ROM, and magneto-optical disk), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic cards, or optical cards. In other words, the readable storage media includes any medium by which a device (e.g., a computer) stores or transmits information in a readable form.

[0149] According to the technical solution provided in the embodiments of this application, by matching the payload of the test data packet sequence that meets the set sequence number requirement in the buffer of the data stream with the feature nodes of the feature dictionary tree, it is possible to detect whether the test data packet is an attack data packet. This eliminates the need to obtain all the fragmented data packets corresponding to the attack data packet and then detect each fragmented data packet in turn, thereby reducing the system overhead of attack detection and improving detection efficiency.

[0150] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0151] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0152] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0153] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An attack detection method, characterized in that, The method includes: Acquire data packets of a preset type in the network and determine the data stream corresponding to the data packets; the data packets of the preset type are fragmented data packets of the attack data packets to be tested; Based on the sequence number and data length of the data packet, the data packet is compared with the data packet sequence in the buffer of the corresponding data stream; in response to the fact that the sequence number between the sequence number and the acknowledgment number of the data packet does not exist in the sequence number sequence corresponding to the data packet sequence, it is determined that the data packet meets the set requirements, wherein the acknowledgment number includes the sum of the sequence number and the data length of the data packet; the test data packets that meet the set requirements are stored in the buffer of the data stream in the order of their sequence numbers; wherein, the set requirements include that the data packet type is out-of-order data packet; In response to the data packet sequence in the buffer meeting the set sequence number requirement, the most recently matched feature node associated with the data stream is obtained; according to the sequence number order of the data packet sequence to be tested, starting from the most recently matched feature node, the payload of the data packet sequence to be tested is matched with the feature nodes of the feature dictionary; the feature dictionary is constructed based on the feature strings corresponding to the attack behavior and the AC automaton algorithm; wherein, the set sequence number requirement includes the sequence number of one data packet and the sequence number of the other data packet whose sum of data lengths equals that of any two adjacent data packets; the most recently matched feature node associated with the data stream is the most recent successfully matched feature node in the process of matching the data packet corresponding to the data stream with the feature dictionary; it is not necessary to detect each fragment data packet sequentially after obtaining all fragment data packets corresponding to the attack data packet to be tested; In response to a situation where the sequence of data packets in the buffer does not meet the set sequence number requirement and the sequence of data packets in the buffer exceeds the memory limit, the data packets in the buffer are deleted. If the payload and the feature node are successfully matched, the data packet corresponding to the payload is determined to be an attack data packet.

2. The method according to claim 1, characterized in that, The preset type includes the Transmission Control Protocol (TCP) type.

3. The method according to claim 1, characterized in that, The method further includes: If there is no corresponding buffer for the data stream corresponding to the data packet, a buffer is allocated for the data stream, and the most recently matched feature node associated with the data stream includes the root node of the feature trie.

4. The method according to claim 1, characterized in that, The method further includes: After the test data packet sequence is matched with the feature dictionary, the last successfully matched feature node of the test data packet sequence and the feature dictionary is determined, and the most recently successfully matched feature node associated with the data stream is updated to the last successfully matched feature node.

5. An attack detection apparatus for executing the attack detection method according to any one of claims 1-4, characterized in that, The device includes: The data packet acquisition module is used to acquire data packets of a preset type in the network and determine the data stream corresponding to the data packets; A data packet caching module is used to store test data packets that meet the set requirements in the data packet into the buffer area of ​​the data stream according to the sequence number; The matching module is used to match the payload of the data packet sequence to be tested in the data packet sequence with the feature nodes of the feature dictionary tree in response to the data packet sequence in the buffer meeting the set sequence number requirement; the feature dictionary tree is constructed based on the feature strings corresponding to the attack behavior and the AC automaton algorithm; The result determination module is used to determine that the data packet corresponding to the payload is an attack data packet when the payload and the feature node are successfully matched.

6. An electronic device, characterized in that, include: Processor, memory; The memory is used to store computer programs; The processor is configured to execute the attack detection method as described in any one of claims 1-4 by invoking the computer program.

7. A readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the attack detection method as described in any one of claims 1-4.

Images