A message processing method and system for responding to port scanning

Abstract

The application discloses a message processing method and system for coping with port scanning, relates to the technical field of optical access networks, and comprises the following steps: judging whether the change rate of the destination port number of the message with the same source IP address is greater than a preset threshold value; if yes, judging that port scanning occurs; and if no, judging that port scanning does not occur. The message subjected to port scanning is received at a limited speed, the message subjected to no port scanning is inquired from a business socket table, the message is identified as a scanning message and discarded when the data payload and the preset scanning data comparison result are the same and the business socket is bound. The application can accurately identify and process high-risk message flows in the port scanning and business symbiotic scenarios, the message flows are split multiple times while being received at a limited speed, the quality of service of key business is preferentially ensured, the scanning messages are discarded, and the processing efficiency of the equipment on the messages is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of optical access network, in particular to a packet processing method and system for coping with port scanning. BACKGROUND

[0002] With the large-scale deployment of PON (Passive Optical Network) access services, especially the batch online of new services such as 5G big data and cloud services, operators are increasingly demanding the security of access network center node devices such as OLT (Optical Line Terminal) and ONU (Optical Network Unit) to ensure customer service quality and satisfaction. Various security access standards have been implemented in the industry to ensure that network devices have no obvious security vulnerabilities as a response to the implementation of national network security construction.

[0003] Among them, the most common situation is that the network management center of each operator will periodically use industry-standard automated scanning kits to perform network inspection, such as the nessua and nmap scanning tools to check whether the network device system protocol stack has exploitable attack vulnerabilities. In this process, the device deploying the scanning tool will send a large number of TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) probe packets to the OLT device, covering the entire global port number range for traversal. The CPU (Central Processing Unit) performance of the OLT system and normal business traffic will be greatly impacted, and in severe cases, it may even cause the device to directly lose management or business interruption.

[0004] The specific process of the above detection is: constructing TCP / UDP four-layer port number changing scanning packets. When the OLT device has an application layer module (or upper application program) bound to the corresponding port number in the system protocol stack, there is no response packet processing. When the OLT device does not have an application layer module bound to the corresponding port number in the system protocol stack, it will reply with an ICMP destination port unreachable message. The scanning tool can detect whether the OLT device has opened some ports according to the two different performances, and then attack the port vulnerabilities. Among them, the global port number refers to 1-65535, covering all possible values of the 2-byte port number field, and after traversal, all application ports used by the device can be obtained. The security vulnerability refers to the application layer module enabling various TCP / UDP ports in the system protocol stack. If the port is detected by the scanning tool, it is considered to be a security vulnerability risk and may be maliciously exploited.

[0005] To cope with such a scenario, a common solution is to deploy a special firewall front-end device to limit the speed of the scanning packet. For example, using hardware ACL (Access Control Lists) rules to match the data packet passing through the hardware switching chip according to the configured five-tuple characteristics (source IP address, destination IP address, source TCP / UDP port number, destination TCP / UDP port number, IP protocol number), and if the matching is successful, the speed is limited, and the packet exceeding the speed limit value is discarded. From the principle, it can be seen that one destination port number needs one ACL rule to match and take effect, and if it covers all global ports, it may consume 65535 rules, and in addition to normal business, the hardware reserved rules are usually only a few hundred, which has exceeded the limit of hardware resources and cannot be used commercially.

[0006] Therefore, on the one hand, due to the dynamic change of the port number of the packet, the hardware ACL rule on which the speed limit depends cannot cover the number of global ports, the protection capability is limited, and it cannot be effectively used for a long time. On the other hand, this identification method is based on the network five-tuple characteristics, and the data characteristics analysis is not sufficient. When the scanning tool is deployed on the network management server and runs, it is completely the same from the five-tuple perspective, only the internal data payload content of the packet is different, and it cannot distinguish between normal network management SNMP (Simple Network Management Protocol) business packets and scanning packets, which may cause misjudgment, resulting in the discarding of key business packets and affecting normal network operation and maintenance.

[0007] In summary, the port scanning tool deployed in the existing network detects network device vulnerabilities and network operation and maintenance scenarios, which may impact device performance and key business protection capabilities, and affect customer perception. The deployment cost of the traditional firewall is too high, and it cannot accurately identify the scanning packets with dynamic port changes, and it also cannot distinguish between business data and scanning data. In particular, when the packet of a single port number does not reach the speed limit threshold, it cannot trigger the punishment strategy, the sensitivity perception ability is weak, and it is difficult to make real-time response. SUMMARY

[0008] In view of the defects in the prior art, the purpose of the present application is to provide a packet processing method and system for coping with port scanning, which can accurately identify and process high-risk packet flows in the port scanning and business coexistence scenario, and at the same time, the packet flow is divided multiple times, the quality of service of the key business is preferentially guaranteed, and the scanning packets are discarded, thereby ensuring the processing efficiency of the device for the packet.

[0009] To achieve the above purpose, the technical scheme adopted is:

[0010] The first aspect of the present application provides a packet processing method for coping with port scanning, the method comprising:

[0011] Cache incoming messages and their identity information, including source IP address and destination port number;

[0012] When there is a message flow with the same source IP address and a destination port number change rate greater than a preset threshold, the message flow is received at a limited rate;

[0013] At the same time, the service socket table is queried using the destination port number; for messages with unbound service sockets, an Internet Control Message Protocol (ICMP) destination port unreachable message is replied; for messages with bound service sockets, the data payload is compared with the preset scanning data. If the comparison result is the same, the message is discarded; if the comparison result is different, the message is pushed to the system protocol stack.

[0014] In some embodiments, determining whether there is a packet flow with the same source IP address and a destination port number change rate greater than a preset threshold specifically includes the following steps:

[0015] Maintaining a feature database table with a preset life cycle, which is used to store a source IP address and at least one destination port number associated with the source IP address;

[0016] Every time the device receives a message, it uses its identity information to query the feature library table to obtain the query result, and determines whether the feature library table is empty based on the query structure; when the feature library table is empty, the identity information is stored in the feature library table; when the feature library table is not empty, it determines whether to update the feature library table based on the source IP address in the feature library table and the source IP address of the message.

[0017] In some embodiments, when the query result is that the source IP address in the feature library table is the same as the source IP address of the message, the destination port number of the message is stored in the feature library table, and the change rate of the destination port number is calculated to be greater than a preset threshold. If so, it is determined that a port scan has occurred and the feature library table is cleared; if not, and the timestamp of the current message differs from the timestamp of the earliest written feature library table by more than a preset life cycle, the feature library table is cleared; if not, and the timestamp of the current message differs from the timestamp of the earliest written feature library table by no more than a preset life cycle, the feature library table is not cleared.

[0018] In some embodiments, when the query result is that the source IP address in the feature library table is different from the source IP address of the message, continue to determine whether the timestamp of the current message differs from the timestamp of the earliest written feature library table by more than the life cycle. If so, clear the feature library table; if not, do not clear the feature library table.

[0019] In some embodiments, calculating whether the change rate of the destination port number is greater than a preset threshold specifically includes the following steps:

[0020] Compare the destination port number in the current message flow with the destination port number in the signature database table, add the newly appeared destination port number to the signature database table, calculate the destination port number change rate, and determine whether the destination port number change rate is greater than the preset threshold.

[0021] In some embodiments, the step of limiting the rate of receiving messages specifically includes the following steps:

[0022] Determine whether the number of issued ACL speed limit rules contained in the device hardware blacklist table does not exceed the preset limit, and whether there is no ACL speed limit rule associated with the source IP address of the current message; if so, configure the guaranteed bandwidth speed limit value and the burst bandwidth speed limit value according to the device performance, combine the source IP address type, source IP address, destination port number, guaranteed bandwidth speed limit value, and burst bandwidth speed limit value to generate an ACL speed limit rule with a preset aging period, and limit the message according to the rule; if not, return to continue judging.

[0023] In some embodiments, the receiving of messages at a limited rate further includes the following steps:

[0024] Periodically poll the hardware blacklist entries to clear aged ACL rate limit rules.

[0025] In some embodiments, the method further comprises:

[0026] After querying the service socket table using the destination port number, the port bound to the service socket is dyed white, and the destination port of the unbound service socket is dyed black;

[0027] For messages whose destination port number in the message identity information corresponds to a white port, reply with an Internet Control Message Protocol (ICMP) destination port unreachable message;

[0028] For messages whose destination port number in the message identity information corresponds to a black port, its data payload is compared with the preset scan data. If the comparison result is the same, the message is discarded; if the comparison result is different, the message is pushed to the system protocol stack.

[0029] In some embodiments, the method further comprises:

[0030] Record the entire message processing process in the device's system log and report the log to an external device.

[0031] A second aspect of the present application provides a message processing system for responding to port scanning, the system comprising:

[0032] A port scanning analysis module is configured to cache the packets entering the device and identity information thereof, the identity information including a source IP address and a destination port number; and to perform rate-limiting reception on the packets when there are packets with the same source IP address and a destination port number change rate greater than a preset threshold.

[0033] A rate-limiting punishment module is configured to control the port scanning analysis module to perform rate-limiting reception on the packets when the port scanning analysis module determines that port scanning occurs.

[0034] A shunt processing module is configured to query a service socket table using the destination port number; to reply to the packets that are not bound to the service socket with an ICMP destination port unreachable message; to compare the data payload of the packets that are bound to the service socket with preset scanning data, and to discard the packets when the comparison result is the same and to push the packets to a system protocol stack when the comparison result is different; and to push the data packets to the system protocol stack when the port scanning analysis module determines that port scanning does not occur.

[0035] The technical scheme provided by the application has the following beneficial effects:

[0036] (1) The occurrence of port scanning is determined by judging whether the destination port number change rate of the packet stream with the same source IP address is greater than a preset threshold, so that the global range of tcp / udp port scanning is accurately identified, misdiagnosis of a general firewall is avoided, reasonable rate-limiting punishment processing is performed, the scanning result is ensured, resource consumption is reduced, and system performance is balanced.

[0037] (2) The preset threshold of the port change rate supports flexible configuration and adjustment, is suitable for different network environments and different scanning tool scenarios, and is flexible and controllable in deployment and use.

[0038] (3) A feature library table with a preset survival period is maintained, the identity information of the packets used to determine whether port scanning occurs is stored in the table, the feature library table is emptied when the feature library table reaches the aging time or it is determined that port scanning occurs, so that the identity information of subsequent packets is stored again for port scanning determination, hardware occupation is reduced, and the port scanning determination rate is improved.

[0039] (4) For the message flow with port scanning, after querying the global socket table for classification and coloring, the message payload data is extracted and compared with the preset scanning data, and finally it is determined whether there is a scanning message. For the message without a bound business socket, an ICMP destination port unreachable message is directly replied. For the message with a bound business socket but the message payload data does not match the preset scanning data, it is judged to be a normal business message. For the message with a bound business socket but the message payload data matches the preset scanning data, it is judged to be a scanning message and the scanning message is directly discarded, ensuring the uploading and processing of normal business messages and the accurate identification of scanning messages, protecting the security of the system protocol stack and reducing the risk of vulnerability exposure.

[0040] (5) The hardware ACL rate limit rule is based on the source IP address and destination port number in a rough manner, and does not pay attention to the details of the four-layer port in the five-tuple. This saves system resources, reduces the cost of system switching chips, and simplifies management.

[0041] (6) The preset aging period of the hardware ACL rate limit rule is flexible and configurable, which improves the system sensitivity and can quickly restore the high-traffic business of the network channel when the scan ends or weakens.

[0042] (7) The entire process information can be received and processed through the log storage port, which facilitates subsequent scanning and tracing and flexible deployment of other strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 The figure is a flow chart of a method for processing messages in response to port scanning according to an embodiment of the present invention.

[0044] Figure 2 Flowchart of step S2 in an embodiment of the present invention.

[0045] Figure 3 The figure is a flow chart of receiving messages at a limited speed according to an embodiment of the present invention.

[0046] Figure 4 Schematic diagram of the functional modules of the message processing system for responding to port scanning in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The present application is further described in detail below with reference to the accompanying drawings and embodiments.

[0048] The present invention provides a method for processing messages in response to port scanning, which caches messages entering a device and their identity information, including the source IP address and destination port number. The cached messages are not processed temporarily, and different types of messages are processed separately after the port scanning is determined.

[0049] The port scanning judgment specifically comprises judging whether a rate of change of a destination port number of a message stream with a same source IP address is greater than a preset threshold value, if yes, judging that port scanning occurs, and if no, judging that port scanning does not occur. The message stream with port scanning is subjected to speed-limiting reception, and the message stream without port scanning is directly sent to a system protocol stack for subsequent regular processing. The subsequent regular processing refers to processing performed by the device after receiving a normal service message.

[0050] Further, after judging that port scanning occurs, a service socket table is queried according to the destination port number to judge whether the destination port number of the message is bound with a service socket. An ICMP destination port unreachable message is returned to the message without binding the service socket. The data payload of the message with binding the service socket is compared with preset scanning data. When the comparison result is the same, the message is determined as a scanning message and discarded. When the comparison result is different, the message is determined as a normal service message and pushed to the system protocol stack for subsequent regular processing.

[0051] In the embodiment, the message entering the device is buffered first to avoid sending the scanning message to the system protocol stack without processing, and to leak system vulnerabilities. Whether port scanning occurs is judged according to the source IP address and the destination port number of the message. Specifically, whether port scanning occurs is judged by judging whether a rate of change of a destination port number of a message stream from a same source IP address is greater than a preset threshold value. When it is judged that port scanning occurs, the message stream is directly subjected to speed-limiting processing. There is no problem of speed-limiting only the message exceeding the speed-limiting threshold in the prior art. The tcp / udp port scanning in the global range is accurately identified to avoid misdiagnosis of a general firewall, and reasonable speed-limiting punishment processing is performed to guarantee the scanning result, reduce resource consumption, and balance system performance.

[0052] The preset threshold value of the port change rate supports flexible configuration and adjustment, and is suitable for different network environments and different scanning tool scenarios, and is flexible and controllable in deployment and use.

[0053] For the message stream with port scanning, the global socket table is queried for classification, the message payload data is extracted and compared with preset scanning data, and finally whether there is a scanning message is judged. The message without binding the service socket is directly returned with an ICMP destination port unreachable message. The message with binding the service socket but with mismatched message payload data and preset scanning data is judged as a normal service message. The message with binding the service socket but with matched message payload data and preset scanning data is judged as a scanning message, and the scanning message is directly discarded. The normal service message is guaranteed to be sent for processing, and the scanning message is accurately identified. The safety of the system protocol stack is protected, and the risk of vulnerability exposure is reduced.

[0054] Reference Figure 1As shown, an embodiment of a method for processing a message to cope with port scanning is provided, the method comprising:

[0055] Step S1: Cache the message entering the device and its identity information, where the identity information includes the source IP address and destination port number.

[0056] Step S2: Determine whether there is a message flow with the same source IP address whose destination port number change rate is greater than a preset threshold:

[0057] If yes, go to step S3.

[0058] If not, go to step S4.

[0059] Step S3: Determine if a port scan has occurred, rate-limit the message stream, and after receiving the message stream, query the service socket table using the destination port number. For messages not bound to a service socket, reply with an ICMP Destination Port Unreachable message. For messages bound to a service socket, compare their data payload with the preset scan data. If the comparison result is the same, discard the message; if the comparison result is different, push the message to the system protocol stack.

[0060] Step S4: determine that no port scanning occurs, and push the message flow to the system protocol stack.

[0061] In this embodiment, after receiving a message sent by the peer device, the local device records the source IP address and destination port number. Based on the preset threshold of the port change rate configured by the user, the local device flexibly analyzes and identifies whether a port scan occurs in the message stream with the same source IP address received by the current device. If the messages in the message stream received over a period of time have the same source IP address and the number of different destination port numbers for each message exceeds the preset threshold, a port scan is diagnosed to have occurred, and the message stream may contain scanning messages. If scanning is diagnosed, the message is received at a limited rate to prevent a large number of messages from entering the device in a short period of time and affecting the normal operation of the device. If scanning is diagnosed, the message is subsequently processed at a normal speed, for example, reported to the system protocol stack for subsequent processing.

[0062] While limiting the rate of receiving the message stream that is causing the port scan, the service socket table is polled to check whether the upper-layer application has bound the corresponding destination port in the system protocol stack. If the destination port number is not bound to the service socket, it indicates that the upper-layer application has not bound the corresponding destination port, that is, the device has not opened this port. In this case, an ICMP destination port unreachable message is replied at a certain rate to inform the device that the destination port is unreachable. If the service socket is bound and the message payload successfully matches the preset scanning data, indicating that the message is a scanning message, the message is immediately discarded to prevent the device from replying to the scanning tool regarding the message, which could lead to the scanning tool discovering a system vulnerability. If the service socket is bound and the message payload fails to match the preset scanning data, indicating that the message is a normal service message, the message is reported to the system protocol stack for processing. This avoids the problem in the prior art of identifying scanning messages based on the message's five-tuple information. If the scanning tool and the network management system are located on the same device, the five-tuple information of the two is the same, making it impossible for the device to distinguish between scanning messages sent by the scanning tool and normal service messages sent by the network management system. At the same time, after classifying the messages using the source IP address and destination port number, only the message payload of the message bound to the service socket is extracted and compared, which can greatly reduce the equipment load and improve the message processing efficiency.

[0063] In summary, this method can dynamically identify the occurrence of scanning and limit the scanning traffic in the scenario of port scanning and business symbiosis, quickly respond to the scanning results, optimize system performance while giving priority to ensuring the quality of key business services, and then output the correct scanning results, which reduces the user's perception of port scanning events and makes the business experience smoother. At the same time, it also meets the requirements of port scanning access testing.

[0064] Based on the above embodiment, in a specific embodiment, for a message flow in which port scanning occurs, the global socket table is queried for classification, and different destination ports are classified and colored according to the classification results. For example, the destination port of the bound service socket is colored black, and the destination port of the unbound service socket is colored white. The purpose of the table query is to determine which ports have been bound in the system protocol stack, so as to know whether these ports are in use. The purpose of classification and coloring is to distinguish which destination ports in the message flow in which port scanning occurs are used for normal business and which are not used. If they are not used, it means that the corresponding message is a scanning message and needs to be discarded.

[0065] When a device enables an application layer protocol, it creates a corresponding socket and binds it to the corresponding port number. This information is stored in the system protocol stack in a linked list called the global socket table. A socket is mapped to a socket table entry, which may include the source IP address, destination IP address, source port, or destination port. Simply querying the global socket table will determine whether a port is in use.

[0066] Based on the above embodiments, Figure 2 As shown, step S2 is described through a specific embodiment, including:

[0067] Step S21: Maintain a feature database table with a preset life cycle, which is used to store a source IP address and at least one destination port number associated with the source IP address;

[0068] Step S22: After receiving each message, the device uses its identity information to query the feature database table to obtain a query result, and determines whether the feature database table is empty based on the query result:

[0069] If yes, go to step S23.

[0070] If not, go to step S24.

[0071] Step S23: Store the identity information in the feature database table.

[0072] Step S24: Determine whether the source IP address in the signature database table is the same as the source IP address of the message based on the query result:

[0073] If yes, go to step S25.

[0074] If not, go to step S27.

[0075] Step S25: Compare the destination port number in the current message flow with the destination port number in the feature library table, add the newly appeared destination port number to the feature library table, calculate the destination port number change rate, and determine whether the destination port number change rate is greater than a preset threshold:

[0076] If yes, go to step S26.

[0077] If not, go to step S27.

[0078] Step S26: Clear the feature library table, and then go to step S22.

[0079] Step S27: Clear the feature library table when the timestamp of the current message differs from the timestamp of the earliest written feature library table by more than the preset life cycle. If the timestamp of the current message differs from the timestamp of the earliest written feature library table by no more than the preset life cycle, the feature library table is not cleared, and then go to step S22.

[0080] In this embodiment, the identity information of a message is stored in step S23 and the corresponding timestamp is stored at the same time. Subsequently, the timestamp of the first destination port number stored in the feature library table can be used as the starting point to calculate whether the feature library table has reached the preset life cycle.

[0081] Step S24 judges that the source IP address in the feature library table is same as the source IP address of the packet, and judges whether the destination port number of the currently received packet exists in the feature library table. If the destination port number does not exist, the destination port number is stored as a first existing port number in the feature library table, and the number of all port numbers in the feature library table in a period of time is calculated to determine whether the number exceeds a preset threshold. If the destination port number of the currently received packet exists, the port number is not stored repeatedly in the feature library table.

[0082] Step S24 judges that the source IP address in the feature library table is different from the source IP address of the packet, and if the time stamp of the current packet exceeds the time stamp of the earliest packet written in the feature library table by more than the survival period, the identity information of the current packet is directly written into the feature library table, and then the step S22 is performed.

[0083] By maintaining the feature library table with a preset survival period, the packet identity information used for judging whether port scanning occurs is stored in the table, and the feature library table is emptied when the aging time is reached or when it is judged that port scanning occurs, so that the identity information of subsequent packets is stored again to perform port scanning judgment, thereby reducing hardware occupation and improving the port scanning judgment rate.

[0084] In other embodiments, the feature library table can also store the IP address type, and the identity information of the packet can also include the IP address type. Before step S22, the Ethernet type field in the packet can also be parsed to determine whether it is an IPv4 or IPv6 packet to filter and discard other packets, and the transmission layer format of the packet is parsed to filter and discard packets in non-TCP and UDP formats.

[0085] The identity information of the TCP / UDP data packet entering the device is cached, and the source IP address, destination port number, and IP address type (ipv4 or ipv6) are selected as reference information for learning to generate a feature library table. Subsequent determination is made as to whether there is a data stream matching the reference feature. If there is no data stream within 1s, the reference information is deleted, and new flow features are learned again. If there is a data stream matching the reference feature, the data stream enters the next scanning and analysis process.

[0086] Based on the above embodiments, as shown in FIG. 8, the rate limiting reception of the packet includes: Figure 3

[0087] Step S31a judges whether the number of ACL rate limiting rules contained in the device hardware blacklist table exceeds a preset limit and whether there is an ACL rate limiting rule associated with the source IP address of the current packet.

[0088] If yes, step S32a is performed. ​

[0089] If not, go to step S33a.

[0090] Step S32a, according to the device performance configuration, the guaranteed bandwidth speed limit value and the burst bandwidth speed limit value are generated, and the ACL speed limit rule with a preset aging period is generated by combining the source IP address type, source IP address, destination port number, guaranteed bandwidth speed limit value, and burst bandwidth speed limit value, and the rule is sent to the device where the source IP address is located, and then go to step S32a.

[0091] Step S33a: Periodically poll the hardware blacklist entries to clear out aged ACL rate limit rules.

[0092] In this embodiment, the hardware blacklist table records the source IP address, IP address aging time, and the number of hardware speed limit rules issued. The preset aging period of the ACL speed limit rule is the same as the IP address aging time. ACL speed limit rules are issued based on the hardware blacklist table to limit the speed of packets entering the device that match the blacklist. Simultaneously, a background timer is started to periodically poll to check whether the source IP address has expired. Subsequently, when a source IP address reaches its aging time, the hardware blacklist table is directly cleared, and the corresponding ACL speed limit rule is deleted, dynamically adjusting to adapt to environmental changes.

[0093] The hardware ACL rate limit rule is based on the source IP address and destination port number in a rough manner, and does not pay attention to the details of the four-layer port in the five-tuple, which saves system resources, reduces the cost of system switching chips, and simplifies management.

[0094] The preset aging period of the hardware ACL rate limit rule is flexible and configurable, which improves the system sensitivity and can quickly restore the high-traffic business of the network channel when the scan ends or weakens.

[0095] In some other embodiments, the method also includes a process for recording relevant logs and alarms in the system background as part of the intelligent operation and maintenance big data, allowing users to make other response decisions. Through the relevant event-driven and mapping processes, this data is spliced ​​into a background log and alarm library, which can be exported to the intelligent operation and maintenance big data platform as a data source for analysis at any time.

[0096] Specifically, key response action behaviors and scanning source information are recorded in a system log, including a hardware blacklist table rule issuing action, a hardware blacklist table rule aging deletion action, a scanning port coloring action, a business data releasing action, a scanning source IP address set, a scanning destination port set, a scanning time, a scanning duration, a scanning stop recovery time, and the like. Meanwhile, according to user customization requirements, key parts of the information are organized into alarm information and reported to a network management server. Subsequent device manufacturers will take other coping strategies according to the information, such as avoiding sensitive periods, ensuring the QoS (Quality of Service) of key data, upgrading application programs, and repairing system vulnerabilities in time.

[0097] As shown in Figure 4 The embodiment of the present application provides a message processing system for coping with port scanning, which comprises a port scanning analysis module 1, a shunt processing module 2, and a speed limiting punishment module 3. The port scanning analysis module 1 is connected to the shunt processing module 2 and the speed limiting punishment module 3.

[0098] The port scanning analysis module 1 buffers the messages entering the device and the identity information thereof, and judges whether the change rate of the destination port number of the messages with the same source IP address is greater than a preset threshold. If yes, the port scanning analysis module 1 judges that port scanning occurs, and notifies the shunt processing module 2 and the speed limiting punishment module 3. If no, the port scanning analysis module 1 judges that port scanning does not occur.

[0099] The shunt processing module 2 is used for querying a business socket table by using the destination port number after the port scanning analysis module 1 judges that port scanning occurs. ICMP destination port unreachable messages are replied to the messages without binding the business socket. The data payload of the messages with binding the business socket is compared with preset scanning data, and the messages are discarded when the comparison result is the same, and the messages are pushed to a system protocol stack when the comparison result is different. The shunt processing module 2 is also used for pushing the data messages to the system protocol stack after the port scanning analysis module 1 judges that port scanning does not occur.

[0100] The speed limiting punishment module 3 is used for controlling the port scanning analysis module 1 to limit the reception of the messages after the port scanning analysis module 1 judges that port scanning occurs.

[0101] In this embodiment, a port scan analysis module 1 runs on an optical access network node device, records the source IP address and destination port number, enables a scan timer, and flexibly analyzes and identifies whether a port scan is occurring in the message stream received by the current device CPU based on a user-configured port change rate threshold. If a scan is detected, the port scan analysis module 1 notifies the rate limit penalty module 3. The rate limit penalty module 3 records the payload of the first scan message, automatically generates an ACL rate limit rule, and sends it to the hardware switching chip according to the user-configured aging time. Scan messages that match the source IP address and destination port number are placed in a designated queue and rate-limited in the inbound direction. If the aging time of the ACL rate limit rule expires, it triggers another analysis and calculation of the destination port change rate for the source IP address. If the rate change rate falls below the threshold, the corresponding ACL rate limit rule is deleted, restoring normal service channels.

[0102] On the other hand, the port scanning analysis module 1 notifies the diversion processing module 2, which actively matches the system business, polls the global socket, and finds out whether the scanning port is bound. The port is marked accordingly. If the business socket is bound, the subsequent related message flow of the port will be directly taken over and processed by the diversion processing module 2. For the data of the business-irrelevant scanning port, the ICMP destination port unreachable response message will be replied at a certain rate. The business-related port will match the data payload content after the message IP header. If it is a scanning content, it will be discarded directly. If it is a normal business message, it will be transferred to the system protocol stack for processing.

[0103] Furthermore, the port scan analysis module 1 is further configured to maintain a feature library table with a preset life cycle, which is configured to store a source IP address and at least one destination port number associated with the source IP address.

[0104] After receiving each message, the port scanning analysis module 1 uses its identity information to query the feature library table to obtain the query result, and determines whether to update the feature library table based on the query result, and determines whether there is a message flow with the same source IP address and the destination port number change rate is greater than the preset threshold.

[0105] Furthermore, when the query result shows that the feature database table is empty, the identity information is stored in the feature database table.

[0106] If the query result shows that the source IP address in the signature database table is the same as the source IP address of the message, the destination port number of the message is stored in the signature database table and the rate of change of the destination port number is calculated to see if it exceeds the preset threshold. If so, a port scan is determined to have occurred and the signature database table is cleared. If not, and the difference between the timestamp of the current message and the timestamp of the earliest signature database entry exceeds the preset lifetime period, the signature database table is cleared. If not, and the difference between the timestamp of the current message and the timestamp of the earliest signature database entry does not exceed the preset lifetime period, the signature database table is not cleared.

[0107] If the query result shows that the source IP address in the signature database table is different from the source IP address of the message, the system will continue to check whether the timestamp of the current message and the timestamp of the earliest signature database table entry differ by more than the lifetime period. If so, the signature database table will be cleared. If not, the signature database table will not be cleared.

[0108] Furthermore, Speed ​​Limit Penalty Module 3 determines whether the number of issued ACL speed limit rules in the device hardware blacklist does not exceed a preset limit, and whether no ACL speed limit rules exist for the source IP address of the current message. If so, it generates an ACL speed limit rule with a preset aging period based on the device's performance configuration, combining the source IP address type, source IP address, destination port number, guaranteed bandwidth limit, and burst bandwidth limit, and sends the rule to the device where the source IP address resides. If not, the process returns to continue the determination.

[0109] Periodically poll the hardware blacklist entries to clear aged ACL rate limit rules.

[0110] Furthermore, the offload processing module 2 searches the service socket table using the destination port number, classifies and colors the destination port numbers of bound service sockets and the destination interface numbers of unbound service sockets, and obtains service port numbers with different colors.

[0111] The present application is not limited to the above-mentioned embodiments. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications are also considered to be within the scope of protection of the present application.

Claims

1. A method for processing messages to cope with port scanning, characterized in that: The method comprises: Cache incoming messages and their identity information, including source IP address and destination port number; When there is a message flow with the same source IP address and a destination port number change rate greater than a preset threshold, it is determined that a port scan has occurred and the message flow is received at a limited rate; After determining that a port scan has occurred, the service socket table is queried using the destination port number; for messages with unbound service sockets, an Internet Control Message Protocol (ICMP) destination port unreachable message is replied; for messages with bound service sockets, the data payload is compared with the preset scan data. If the comparison result is the same, the message is discarded; if the comparison result is different, the message is pushed to the system protocol stack.

2. The method for processing a message to cope with port scanning according to claim 1, characterized in that: Determining whether there is a message flow with the same source IP address and a destination port number change rate greater than a preset threshold specifically includes the following steps: Maintaining a feature database table with a preset life cycle, which is used to store a source IP address and at least one destination port number associated with the source IP address; After receiving each message, the device uses its identity information to query the signature database table to obtain the query result, and determines whether the signature database table is empty based on the query structure; When the feature database table is empty, the identity information is stored in the feature database table; When the signature database table is not empty, determine whether to update the signature database table based on the source IP address in the signature database table and the source IP address of the message.

3. The message processing method for coping with port scanning according to claim 2, characterized in that: If the query result is that the source IP address in the feature library table is the same as the source IP address of the message, the destination port number of the message is stored in the feature library table, and the change rate of the destination port number is calculated to be greater than a preset threshold. If so, it is determined that a port scan has occurred and the feature library table is cleared; If not, and the time stamp of the current message differs from the time stamp of the earliest written signature database table by more than the preset life cycle, the signature database table is cleared; If not, and the time stamp of the current message differs from the time stamp of the earliest written signature database table by no more than the preset life cycle, the signature database table will not be cleared.

4. The method for processing a message to cope with port scanning according to claim 2, characterized in that: When the query result is that the source IP address in the feature library table is different from the source IP address of the message, continue to determine whether the timestamp of the current message and the timestamp of the earliest written feature library table are different by more than the life cycle. If so, clear the feature library table; If not, the feature library table will not be cleared.

5. The message processing method for coping with port scanning according to claim 3 is characterized in that: The step of calculating whether the change rate of the destination port number is greater than a preset threshold specifically includes the following steps: Compare the destination port number in the current message flow with the destination port number in the signature database table, add the newly appeared destination port number to the signature database table, calculate the destination port number change rate, and determine whether the destination port number change rate is greater than the preset threshold.

6. The message processing method for coping with port scanning according to claim 1, characterized in that: The method of receiving the message flow at a limited speed specifically includes the following steps: Determine whether the number of issued ACL speed limit rules contained in the device hardware blacklist table does not exceed the preset limit, and whether there is no ACL speed limit rule associated with the source IP address of the current message; if so, configure the guaranteed bandwidth speed limit value and the burst bandwidth speed limit value according to the device performance, combine the source IP address type, source IP address, destination port number, guaranteed bandwidth speed limit value, and burst bandwidth speed limit value to generate an ACL speed limit rule with a preset aging period, and limit the message according to the rule; if not, return to continue judging.

7. The message processing method for coping with port scanning according to claim 1, characterized in that: The method of receiving the message flow at a limited speed further includes the following steps: Periodically poll the hardware blacklist entries to clear aged ACL rate limit rules.

8. The message processing method for coping with port scanning according to claim 1, characterized in that: The method further comprises: After querying the service socket table using the destination port number, the port bound to the service socket is dyed white, and the destination port of the unbound service socket is dyed black; For messages whose destination port number in the message identity information corresponds to a white port, reply with an Internet Control Message Protocol (ICMP) destination port unreachable message; For messages whose destination port number in the message identity information corresponds to a black port, its data payload is compared with the preset scan data. If the comparison result is the same, the message is discarded; if the comparison result is different, the message is pushed to the system protocol stack.

9. The message processing method for coping with port scanning according to claim 1, characterized in that: The method further comprises: Record the entire message processing process in the device's system log and report the log to an external device.

10. A message processing system for responding to port scanning, characterized in that: The system comprises: A port scan analysis module is used to cache incoming messages and their identity information, including the source IP address and destination port number. It is also used to determine that a port scan has occurred when there is a message flow with the same source IP address and a destination port number change rate greater than a preset threshold, and to limit the rate of reception of the message flow. A speed limit penalty module, which is used to control the port scan analysis module to limit the speed of receiving the message flow after the port scan analysis module determines that a port scan has occurred; The diversion processing module is used to use the destination port number to query the service socket table after determining that a port scan has occurred; reply with an ICMP destination port unreachable message for messages that are not bound to a service socket; compare the data payload of messages that are bound to a service socket with the preset scan data, discard the message when the comparison result is the same, and push the message to the system protocol stack when the comparison result is different; and push the message stream to the system protocol stack after the port scan analysis module determines that no port scan has occurred.

Images