Method and apparatus for attack and defense drill based on programmable switch

Abstract

The present disclosure provides a programmable switch-based attack and defense drill method and device, and relates to the technical field of network security. The specific implementation scheme is: obtaining a seed domain name system (DNS) query data packet; obtaining address information of a specified DNS server and IP address information of a target host to be verified; updating the seed DNS query data packet according to the address information of the specified DNS server and the IP address information of the target host to be verified; generating a DNS query data packet according to the updated seed DNS query data packet; and generating DNS reflection amplification attack traffic based on the updated seed DNS query data packet and the DNS query data packet, so as to verify the defense system of the target host. The present disclosure can improve the attack traffic generation speed of DNS reflection amplification attack drills while meeting flexibility, and improve the attack efficiency of network security attack and defense drills.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a method and apparatus for attack and defense drills based on a programmable switch. Background Technology

[0002] With the development of the internet age, people are using more and more websites daily. Since remembering all websites using IP (Internet Protocol) addresses is difficult, hostnames were developed to represent the corresponding servers. These hostnames are then converted into IP addresses through domain name resolution. The protocol that standardizes this process is called DNS (Domain Name System).

[0003] DNS reflection amplification attacks exploit the characteristic that DNS network protocol response packets are larger than request packets, sending a large number of requests to the target server, thus overwhelming it. Attackers forge the source IP address of the request packets to the victim's IP address, diverting response packet traffic to the victim's server, consuming network resources, and blocking normal network services.

[0004] Existing methods for generating DNS reflection amplification attacks mostly involve writing software scripts to generate abnormal traffic, which is then sent across the network via the host's network interface card (NIC) to launch the attack. The drawbacks of this approach are that the software-generated abnormal traffic is relatively slow (often gigabit speeds), resulting in low attack efficiency. Furthermore, the attacker needs to control a large number of hosts simultaneously, which is time-consuming and labor-intensive. Summary of the Invention

[0005] This disclosure provides a method and apparatus for attack and defense drills based on a programmable switch.

[0006] According to a first aspect of this disclosure, a method for attack and defense drills based on a programmable switch is provided, comprising:

[0007] Obtain the seed Domain Name System (DNS) query data packet;

[0008] Obtain the address information of the specified DNS server and the IP address information of the target host to be verified;

[0009] The seed DNS query data packet is updated based on the address information of the specified DNS server and the IP address information of the target host to be verified;

[0010] A DNS query packet is generated based on the updated seed DNS query packet, and DNS reflection amplification attack traffic is generated based on the updated seed DNS query packet and the DNS query packet to test the defense system of the target host.

[0011] According to a second aspect of this disclosure, a defense and attack exercise device based on a programmable switch is provided, comprising:

[0012] The first acquisition module is used to acquire seed Domain Name System (DNS) query data packets;

[0013] The second acquisition module acquires the address information of the specified DNS server and the IP address information of the target host to be verified.

[0014] The update module is used to update the seed DNS query data packet according to the address information of the specified DNS server and the IP address information of the target host to be verified;

[0015] The attack and defense exercise module is used to generate DNS query packets based on the updated seed DNS query packets, and to generate DNS reflection amplification attack traffic based on the updated seed DNS query packets and DNS query packets, so as to test the defense system of the target host.

[0016] According to a third aspect of this disclosure, an attack and defense drill system is provided, comprising:

[0017] Electronic devices are configured to generate seed Domain Name System (DNS) query packets;

[0018] A programmable switch is configured to implement the method described in the first aspect above.

[0019] According to a fourth aspect of this disclosure, a programmable switch is provided, comprising:

[0020] At least one processor; and

[0021] A memory that is communicatively connected to at least one processor; wherein,

[0022] The memory stores instructions that can be executed by at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0023] According to a fifth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the method described in the first aspect above.

[0024] According to the technical solution of this disclosure, relying on the high flexibility and high throughput of programmable switches, DNS reflection amplification attack traffic is quickly generated based on programmable switches to test the defense system of the attacked party for attack and defense drills. Compared with traditional attack and defense drill schemes, the scheme proposed in this disclosure can improve the traffic generation rate to quickly generate large-scale traffic, and can complete DNS reflection amplification attack and defense drills in a time-saving and labor-saving manner without controlling a large number of devices.

[0025] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0026] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0027] Figure 1 This is a flowchart illustrating a DNS reflection amplification attack drill method based on a programmable switch, as provided in an embodiment of this disclosure.

[0028] Figure 2 This is a schematic diagram of a process for generating a seed DNS query data packet provided in an embodiment of this disclosure;

[0029] Figure 3 This is a flowchart illustrating the DNS reflection amplification attack and defense exercise program design based on P4 language provided in this embodiment of the disclosure;

[0030] Figure 4 This is a structural block diagram of a DNS reflection amplification attack training device based on a programmable switch, provided in an embodiment of this disclosure.

[0031] Figure 5 This is a schematic diagram of the interaction process of the DNS reflection amplification attack drill system based on a programmable switch provided in this embodiment of the disclosure.

[0032] Figure 6 This is a block diagram of a programmable switch used to implement an attack and defense exercise method based on a programmable switch, according to an embodiment of the present disclosure. Detailed Implementation

[0033] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0034] First, to facilitate understanding of this disclosure by those skilled in the art, the DNS protocol workflow is briefly described below, which may include the following steps 101' to 106':

[0035] Step 101': The user queries the nearest DNS caching server for the IP address of a domain name (e.g., www.example.com).

[0036] Step 102': If the server does not have a URL corresponding to the domain name, the server will send a query request to the root name server.

[0037] Step 103': The root authority server tells the cache server the addresses of other authority servers.

[0038] Step 104': The cache server queries other authoritative servers.

[0039] Step 105: The authoritative server returns the IP address corresponding to the domain name to the cache server.

[0040] Step 106': The cache server returns the IP address corresponding to the domain name to the user.

[0041] It is worth noting that steps 104' and 105' are usually performed multiple times. During the query, the top-level domain is queried first, followed by queries to the second-level and third-level domain name servers in sequence. Therefore, the cache server is also called a recursive server.

[0042] It's important to note that DNS reflection amplification attacks primarily exploit the characteristic that DNS network protocol response packets are larger than request packets. Attackers send a large number of requests to the target server, overwhelming it. By spoofing the source IP address of the request packets to the victim's IP address, attackers redirect response traffic to the victim's server, consuming network resources and blocking normal network services.

[0043] However, existing DNS reflection amplification attack drills mostly involve generating abnormal traffic through software scripts and then sending that abnormal traffic across the network via the host's network interface card (NIC). This method generates abnormal traffic relatively slowly (often gigabit speeds), resulting in low attack efficiency. Attackers often need to control a large number of hosts simultaneously, which is time-consuming and labor-intensive.

[0044] To this end, this disclosure provides a method and apparatus for DNS reflection amplification attack and defense drills based on a programmable switch. The programmable switch uses a dedicated chip customized by an Ethernet switch chip hardware manufacturer. This chip can achieve hardware-level functional customization while retaining the high throughput of traditional switch chips, reaching Tbps. Compared to traditional switches, it has the advantages of high programmability and flexibility; compared to using computer software to construct network data packets, it has the advantage of high throughput (generally thousands of times faster than software generation speed; software: Gbps level speed, programmable switch: Tbps level speed). These two advantages inspired this invention to use a programmable switch to generate abnormal DNS traffic for attack and defense drills. Specifically, the following describes the embodiment of the DNS reflection amplification attack and defense drill method and apparatus based on a programmable switch according to the accompanying drawings.

[0045] Figure 1 This is a flowchart illustrating a DNS reflection amplification attack training method implemented on a programmable switch according to an embodiment of this disclosure. It should be noted that the DNS reflection amplification attack training method based on a programmable switch according to this disclosure can be applied to the DNS reflection amplification attack training device based on a programmable switch according to the embodiments of the application, and this programmable switch-based DNS reflection amplification attack training device can be configured on a programmable switch. Figure 1 As shown, this DNS reflection amplification attack drill method based on a programmable switch includes the following steps:

[0046] Step 101: Obtain the seed Domain Name System (DNS) query data packet.

[0047] In one possible implementation, the data packet to be processed is obtained; the data packet to be processed is parsed to obtain the port number, query request / response QR field and expected recursion RD field in the data packet to be processed; if the port number in the data packet to be processed is determined to be a preset port number, and the QR field in the data packet to be processed is determined to be a first preset value and the RD field is determined to be a second preset value, then the data packet to be processed is determined to be a seed DNS query data packet.

[0048] For example, a programmable switch has the capability to resolve to the application layer DNS protocol, enabling it to parse data packets containing headers for Ethernet, IPv4, UDP, and DNS protocols. Upon receiving a data packet to be processed, the programmable switch can parse it using the aforementioned resolution function to obtain the port number, QR field, and RD field. It then determines whether the port number is a preset port number (e.g., 53), whether the QR field is a first preset value (e.g., 0), and whether the RD field is a second preset value (e.g., 1). If the port number is a preset port number, the QR field is the first preset value, and the RD field is the second preset value, then the data packet to be processed can be identified as a seed DNS query data packet.

[0049] Step 102: Obtain the address information of the specified DNS server and the IP address information of the target host to be verified.

[0050] In one implementation, a matching table can be pre-established. This table includes the address information of the specified DNS server and the IP address information of the target host to be checked.

[0051] In this embodiment, during the initial stage of an attack and defense exercise, the address information of the specified DNS server and the IP address information of the target host to be tested can be obtained from the matching table.

[0052] Optionally, when entering the next stage of the attack and defense exercise, the address information of the specified DNS server and the IP address information of the target host to be tested can be obtained based on the initial address information of the specified DNS server and the initial IP address information of the target host to be tested.

[0053] In one implementation, the address information of the initial designated DNS server can be shifted to obtain the address information of the new designated DNS server, and a modulo operation can be performed on the IP address information of the initial target host to be verified to obtain the IP address information of the new target host to be verified. The address information of the initial designated DNS server can be the address information of the designated DNS server in the matching table, and the IP address information of the initial target host to be verified can be the IP address information of the target host to be verified in the matching table. Alternatively, the address information of the initial designated DNS server and / or the IP address information of the initial target host to be verified can also be information obtained through other means. This disclosure does not limit or elaborate on this.

[0054] Step 103: Update the seed DNS query data packet based on the address information of the specified DNS server and the IP address information of the target host to be verified.

[0055] In one implementation, the values ​​of the corresponding fields in the seed DNS query data packet are replaced based on the address information of the specified DNS server and the IP address information of the target host to be verified.

[0056] For example, programmable switches have the function of processing data packet content, enabling them to replace the content of the Ethernet, IPv4, UDP, and DNS protocol headers in data packets. After obtaining the address information of the specified DNS server and the IP address information of the target host to be verified, the programmable switch can replace the content of the Ethernet, IPv4, UDP, and DNS protocol headers in the data packet to be processed based on the aforementioned processing function. For example, it can replace the source address in the Ethernet, IPv4, UDP, and DNS protocol headers with the IP address information of the target host to be verified, and replace the destination address with the address information of the specified DNS server.

[0057] Step 104: Generate a DNS query packet based on the updated seed DNS query packet, and generate DNS reflection amplification attack traffic based on the updated seed DNS query packet and the DNS query packet to test the target host's defense system.

[0058] In one possible implementation, the seed DNS query packet header and the seed DNS query packet body are cloned to obtain the cloned packet header and its body. The seed DNS query packet and the cloned packet header are then concatenated with their respective bodies. The cloned packet is then identified as a DNS query packet.

[0059] In one possible implementation, after obtaining the DNS query packet, an updated seed DNS query packet is sent to a designated DNS server. The seed DNS query packet is used by the designated DNS server to return a DNS response packet to the target host. Using loopback technology based on a programmable switch, the DNS query packet is used as a new seed DNS query packet, and the process of obtaining the address information of the designated DNS server and the IP address information of the target host to be verified is returned to generate DNS reflection amplification attack traffic.

[0060] It should be noted that in another possible implementation, the updated seed DNS query data packet is cached, and the header of the updated seed DNS query data packet is concatenated with its corresponding body. The resulting concatenated data packet is then sent to a designated DNS server, which uses this data packet to return a DNS response data packet to the target host. Based on the cached seed DNS query data packet header and body, a clone is created to obtain a clone data packet header and body. The seed DNS query data packet and the clone data packet header are then concatenated with their respective bodies; the cloned data packet is then identified as the DNS query data packet.

[0061] In other words, the programmable switch can first perform a cloning operation, and then forward the updated seed DNS query data packet and the DNS query data packet separately. Alternatively, it can first cache the updated seed DNS query data packet and send it to the specified DNS server, and then clone it based on the header and body of the cached seed DNS query data packet to obtain a cloned data packet. The cloned data packet is then identified as a DNS query data packet, and the DNS query data packet is then re-input into the programmable switch ingress port through loopback technology. The switch then returns to execute the steps of obtaining the address information of the specified DNS server and the IP address information of the target host to be verified. This disclosure does not limit the scope of the operation.

[0062] As is understood, DNS reflection amplification attacks primarily exploit the characteristic that DNS network protocol response packets are larger than request packets, sending a large number of requests to the target server, thereby overwhelming the target server. This disclosure utilizes the principle of this DNS reflection amplification attack by setting the source IP address in the DNS query packet to the IP address of the target host to be tested. This redirects the traffic of the response packets to the server of the target host, consuming its network resources and blocking normal network services, thus achieving the purpose of a DNS reflection amplification attack exercise. This can then be used to test the defense system of the target host.

[0063] By implementing the embodiments of this disclosure, the programmable switch can update the seed DNS query data packet based on the address of the specified DNS server and the IP address of the target host to be tested, and generate the DNS query data packet based on the seed DNS query data packet. This enables the rapid generation of DNS reflection amplification attack traffic based on the seed DNS query data packet and the DNS query data packet, which can be used to test the defense system of the target host. This improves the traffic generation rate to quickly generate large-scale traffic, and allows for the completion of DNS reflection amplification attack and defense drills in a time-saving and labor-saving manner without the need to control a large number of devices.

[0064] Figure 2This is a flowchart illustrating a method for generating seed DNS query packets according to an example provided in this disclosure. It should be noted that this method can be executed by an electronic device, or alternatively, by a programmable switch. Figure 2 As shown, the method may include, but is not limited to, the following steps:

[0065] Step 201: Construct a sample DNS query packet.

[0066] For example, DNS query packets can be generated using a network programming language (such as the scapy library in Python), or other network programming languages ​​can be used to generate DNS query packets. This disclosure does not limit this, nor will it elaborate further.

[0067] Optionally, in embodiments of this disclosure, the query type in the DNS query packet sample is set to "ANY". This type of query packet requires the DNS server to fill in all records in the corresponding response packet, making the size of the response packet much larger than the query packet. For example, depending on the requested information, the size of the response packet is about tens of times larger than the query packet, thereby increasing the size of the response packet and achieving the "amplification" effect of the attack.

[0068] Step 202: Set the QR field in the DNS query packet sample to the first preset value, and set the RD field in the DNS query packet sample to the second preset value.

[0069] In one implementation, the RD (Recursion Desired) field of the Flag field in the DNS query packet sample is set to "1" to prompt the DNS server to perform a series of queries to the root name server and various authoritative servers. Ultimately, a large number of unknown DNS query results are fed back to the attacker in the form of response packets, achieving the "reflection" purpose in a DNS reflection amplification attack.

[0070] Step 203: Add a first field to the DNS query packet sample. This first field is used to identify the maximum UDP (User Datagram Protocol) packet size that the attack and defense exercise device can handle.

[0071] The attack and defense exercise equipment can be understood as equipment used for attack and defense exercises. Optionally, in the embodiments of this disclosure, the attack and defense exercise equipment may include, but is not limited to, at least one of the following: a programmable switch, a designated DNS server, and a target host to be tested. As an example, the attack and defense exercise equipment may include a programmable switch, a designated DNS server, and a target host to be tested.

[0072] In one implementation, the first field can be defined as the OPT RR field, or it can be any other name for the field, which is not limited in this disclosure. For example, this disclosure can use the DNS extension mechanism EDNS0 to add an OPT RR field to the DNS query packet sample to identify the maximum UDP packet size that the attack and defense exercise device can handle. Thus, by setting a larger value for this first field, this disclosure can further increase the size of the response packet, thereby further enhancing the "amplification" effect of the attack.

[0073] Optionally, in one implementation, the programmable switch is configured with a program based on the P4 language, which can implement the attack and defense drill method described in any embodiment of this disclosure. For example, the program may include five parts: Header, Parser, Ingress, Egress, and Deparser. The Header part is mainly used to define the protocol headers to be parsed; the Parser part is mainly used for parsing; the Ingress part is mainly used for configuring and executing operations; the Egress part is mainly used for performing cloning operations; and the Deparser part is mainly used for merging the updated DNS query packet header with the original DNS query packet body. Figure 3 As shown, the implementation process of this program may include the following steps:

[0074] Step 301: Define the headers for Ethernet, IPv4, UDP, and DNS protocols in the program Header section so that the data packets to be processed can be resolved to the application layer DNS protocol.

[0075] Step 302: Whenever a data packet is received by the programmable switch, the program begins parsing in the Parser section. When the UDP header is parsed, it checks if the port number is the default port number for the DNS protocol, and based on the port number determination, it determines whether the data packet is a DNS data packet. If the data packet is determined to be a DNS data packet, step 303 is executed; otherwise, the data packet is discarded.

[0076] In one implementation, the default port number for the DNS protocol is 53. If the port number is not 53, the data packet is determined to be a DNS data packet; if the port number is 53, the data packet is determined to be a DNS data packet. The determination of the data packet can be considered successful, and the data packet can continue to be resolved in order to execute step 303.

[0077] Step 303: Determine whether the QR (Question or Response) and RD (Recursion Desired) fields in the parsed data packet are configured correctly, and update the data packet.

[0078] In the embodiments of this disclosure, the following four operations can be performed through the Ingress part of the program: (1) Determine whether the QR (Question or Response) field and RD (Recursion Desired) field in the parsed data packet are configured correctly; (2) Replace the field in the data packet involving the destination address with the specified DNS server address; (3) Replace the field in the data packet involving the source address with the IP address of the destination host to be checked; (4) Update some fields of the domain name to be queried.

[0079] In one implementation, the Ingress section comprises three modules: Action, Table, and Apply. The Action module primarily defines functions related to updating seed DNS query packets; the Table module is a pre-stored matching table; and the Apply module is used to instantiate and execute functions in the Action module, taking information from the Table module as input.

[0080] It should be noted that the participants in the attack and defense exercise pre-determine the IP address of the target host to be tested and the designated DNS server address to induce the sending of DNS response packets to generate a reflection amplification attack. This designated DNS server address information and the target host address information are pre-stored in the Table module. During the P4 program's execution, the Apply module instantiates the Action module and the Table module, using the pre-stored information in the Table module as input, and executes all actions in the Action module. The Action module defines four functions: the first function, the second function, the third function, and the fourth function.

[0081] (1) The first function is configured to check whether the QR (Question or Response) field in the DNS flags is a first preset value and whether the RD (Recursion Desired) field is a second preset value. If both checks are successful, the second function continues to execute; otherwise, the process is discarded.

[0082] For example, check if the QR field in the DNS flags of the seed DNS query packet is 0 and the RD field is 1. If the check is successful, continue executing the second function; otherwise, discard the packet.

[0083] (2) The second function is configured to set up a packet forwarding function, specifying that the address parameters of the DNS server are pre-stored in the Table module.

[0084] Optionally, by setting shift codes, different DNS servers can be guided to send reflected response packets to the target host to be inspected.

[0085] For example, after the seed DNS query packet is forwarded, a bit shift operation is performed on the address parameter of the specified DNS server to obtain the address parameters of different specified DNS servers.

[0086] (3) The third function is configured to set the IP address of the target host to be tested.

[0087] Optionally, when the target host to be tested is not unique, a counter remainder code can be set.

[0088] For example, the modulo operation is performed by dividing the number of sent data packets by 3, and the result is assigned to three different target host addresses to be inspected, so that the program can poll and inspect multiple target hosts in a round-robin fashion.

[0089] (4) The fourth function is configured to set a loop shift function for a certain field of the domain name to be queried, and automatically update the domain name to be queried to prevent the attack effect from being reduced due to the cache of the specified DNS server.

[0090] For example, after the seed DNS query data packet is forwarded, a bit shift operation is performed on the second-level domain name part of the domain name to be queried, so as to realize the automatic update of the domain name to be queried.

[0091] Step 304: In the Egress section, clone the updated seed DNS query packet.

[0092] In one possible implementation, the Egress section clones the updated seed DNS query packet header and body to obtain a cloned packet header and body. Optionally, the Egress section can combine the cloned packet header and body. Optionally, the Egress section uses the cloned packet as a DNS query packet and sends it to the ingress port of the programmable switch via a loopback operation. By repeatedly performing the above steps, DNS reflection amplification attack traffic can be generated.

[0093] In one possible implementation, the Egress part clones the updated seed DNS query packet header and seed DNS query packet body to obtain the cloned packet header and body, which are then merged and forwarded by the Deparser part.

[0094] Step 305: In the Deparser section, combine the headers of the seed DNS query data packet and the clone data packet with their respective packet bodies, and send them to the designated DNS server or perform a loopback.

[0095] In one possible implementation, the Egress part implements the loopback operation on the cloned packets, while the Deparser part combines the seed DNS query packet header with its packet body and sends the seed DNS query packet to the specified DNS server.

[0096] In one possible implementation, the Deparser section combines the headers of the seed DNS query packet and the clone packet with their respective packet bodies, identifies the clone packet as a DNS query packet, and sends it as input to the programmable switch's ingress port. The seed DNS query packet is then sent to the designated DNS server.

[0097] It should be noted that both the Egress and Deparser parts can perform loopback operations. Steps 304 and 305 can be executed in parallel, sequentially, or in different orders. As long as the cloning of the seed DNS query data packet, the splicing and combining of the headers and corresponding bodies of the seed DNS query data packet and the cloned data packet, and the sending of the seed DNS query data packet and the cloned data packet to the designated DNS server and the loopback can be achieved, this disclosure does not impose any restrictions.

[0098] It is worth noting that this program can not only automatically send query information to multiple different DNS servers, but also automatically update the queried domain name, preventing the attenuation of attack drill effectiveness due to DNS server caching. If the DNS server has the IP address of the domain name cached, it may directly return a response packet, no longer forcing the recursive query process. Optionally, in the embodiments of this disclosure, the queried domain name can use an uncommon or randomly generated domain name, thereby improving the attack drill effect.

[0099] Figure 4 This is a structural block diagram of an attack and defense drill device based on a programmable switch provided in an embodiment of this disclosure.

[0100] like Figure 4 As shown, the attack and defense exercise device based on a programmable switch includes a first acquisition module 401, a second acquisition module 402, an update module 403, and an attack and defense exercise module 404.

[0101] The first acquisition module 401 is used to acquire seed domain name system DNS query data packets.

[0102] The second acquisition module 402 acquires the address information of the specified DNS server and the IP address information of the target host to be verified.

[0103] The update module 403 is used to update the seed DNS query data packet according to the address information of the specified DNS server and the IP address information of the target host to be verified.

[0104] The attack and defense exercise module 404 is used to generate a DNS query packet based on the updated seed DNS query packet, and generate DNS reflection amplification attack traffic based on the updated seed DNS query packet and the DNS query packet, so as to test the defense system of the target host.

[0105] In one implementation, the first acquisition module 401 is specifically used to: acquire a data packet to be processed; parse the data packet to be processed to obtain the port number, query request / response QR field and expected recursion RD field in the data packet to be processed; determine that the port number in the data packet to be processed is a preset port number, determine that the QR field in the data packet to be processed is a first preset value and the RD field is a second preset value, and then determine that the data packet to be processed is the seed DNS query data packet.

[0106] In one implementation, the second acquisition module 402 is specifically used to: perform a shift operation on the initial address information of the specified DNS server to obtain the new address information of the specified DNS server; and perform a modulo operation on the initial IP address information of the target host to be tested to obtain the new IP address information of the target host to be tested.

[0107] In some embodiments of this disclosure, the update module 403 is specifically used to: replace the value of the corresponding field in the seed DNS query data packet according to the address information of the specified DNS server and the IP address information of the target host to be verified.

[0108] In some embodiments, the attack and defense exercise module 404 is specifically used to: clone the seed DNS query data packet header and the seed DNS query data packet body based on the updated seed DNS query data packet header and the seed DNS query data packet body to obtain the clone data packet header and the clone data packet body, and concatenate the seed DNS query data packet and the clone data packet header with their respective corresponding packets body; and determine the clone data packet as the DNS query data packet.

[0109] In some embodiments, the attack and defense exercise module 404 is specifically used to: send the updated seed DNS query data packet to the designated DNS server, wherein the seed DNS query data packet is used by the designated DNS server to return a DNS response data packet to the target host; using the loopback technology based on the programmable switch, the DNS query data packet is used as a new seed DNS query data packet, and the step of obtaining the address information of the designated DNS server and the IP address information of the target host to be verified is returned to be executed, so as to generate DNS reflection amplification attack traffic.

[0110] In one implementation, the attack and defense exercise device may further include: a generation module for generating seed DNS query data packets. Specifically, the generation module is used to: construct a DNS query data packet sample; set the QR field in the DNS query data packet sample to a first preset value and set the RD field in the DNS query data packet sample to a second preset value; and enable the DNS extension mechanism EDNS0 to add a first field to the DNS query data packet sample, the first field being used to identify the maximum User Datagram Protocol (UDP) packet size information that the attack and defense exercise device can process.

[0111] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0112] Figure 5 This is a schematic diagram of the interaction flow of an attack and defense exercise system based on a programmable switch, according to an embodiment of this disclosure. The attack and defense exercise system includes an electronic device 501 and a programmable switch 502. Figure 5 As shown, the interaction flow can be as follows:

[0113] Electronic device 501 generates a seed DNS query data packet. The method for generating the seed DNS query data packet can be as described above. Figure 2 The implementation can be carried out in any of the embodiments shown, and will not be described in detail here.

[0114] The programmable switch 502 includes a P4 program, ingress ports, and egress ports, wherein the P4 program is used to implement the methods described in any embodiment of this disclosure. A description of the P4 program can be found above. Figure 3 The descriptions in the illustrated embodiments will not be repeated here. The programmable switch 502 can receive seed DNS query data packets sent by electronic device 501 through the ingress port, and process the seed DNS query data packets accordingly through the P4 program to implement the method described in any embodiment of this disclosure.

[0115] The Domain Name System (DNS) server 503 can receive DNS query packets output by the programmable switch through its outgoing port and send DNS response packets to the target host 504 to be inspected, thereby forming abnormal traffic amplified by DNS reflection, which can be used to verify the reliability of the defense system of the target host 504.

[0116] In one implementation, after the electronic device 501 generates a seed DNS query packet, the seed DNS query packet is forwarded to the ingress port of the programmable switch 502.

[0117] In one implementation, after the cloned data packet is identified as a DNS query data packet, the programmable switch 502 sends the DNS query data packet from the output port of the programmable switch 502 to the input port of the programmable switch 502 to complete the loopback operation and generate a large amount of DNS reflection amplification attack traffic.

[0118] In one implementation, the programmable switch 502 generates large-scale DNS query packets, which are sent from the output port of the programmable switch 502 to a designated DNS caching server. After multiple levels of recursive queries, the designated DNS caching server sends the DNS reflection amplification attack traffic to the target host 504 to be inspected in the form of a DNS response packet.

[0119] like Figure 6 As shown, Figure 6 This is a block diagram of a programmable switch used to implement the attack and defense drill method based on a programmable switch according to embodiments of this disclosure. A programmable switch refers to a switch that uses a programmable switch chip customized by an Ethernet switch chip hardware manufacturer, achieving high flexibility in programmability while retaining the fast packet processing characteristics of traditional switches. Its latency is typically in the nanosecond range, and its throughput can reach Tbps. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of this disclosure described and / or claimed herein.

[0120] like Figure 6 As shown, the programmable switch includes one or more processors 601, a memory 602, an ingress port 603, an egress port 604, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components are interconnected via different buses and can be mounted on a common motherboard or otherwise as required. The processor can process instructions executed within the programmable switch, such as processing seed DNS query packets forwarded to the ingress port 603 of the programmable switch according to program instructions stored in the memory, and then outputting the updated seed DNS query packets from the egress port 604 of the programmable switch. The processor can also process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In other embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple programmable switches can be connected, each providing some of the necessary operations. Figure 6 Take the 601 processor as an example.

[0121] The memory 602 is the non-transitory computer-readable storage medium provided in this disclosure. The memory stores instructions executable by at least one processor to cause the at least one processor to perform the attack training method based on a programmable switch provided in this disclosure. The non-transitory computer-readable storage medium of this disclosure stores computer instructions for causing a computer to perform the attack training method based on a programmable switch provided in this disclosure.

[0122] Memory 602, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the attack and defense exercise method based on a programmable switch in this embodiment of the present disclosure (e.g., attached...). Figure 4 The first acquisition module 401, the second acquisition module 402, the update module 403, and the attack and defense exercise module 404 are shown. The processor Y01 executes various functional applications and data processing of the server by running non-transient software programs, instructions, and modules stored in the memory Y02, thereby realizing the attack and defense exercise method based on the programmable switch in the above method embodiment.

[0123] The memory 602 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the programmable switch in the attack and defense exercise method based on the programmable switch. Furthermore, the memory 602 may include high-speed random access memory and may also include non-transient memory, such as at least one disk storage device, flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 602 may optionally include memory remotely located relative to the processor 601, and these remote memories can be connected to the programmable switch in the attack and defense exercise method based on the programmable switch via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0124] Ingress port 603 is an Ethernet switch port, which is an interface for connecting other physical devices, such as other switches, routers, hosts and other physical devices. It includes physical ports and logical ports and can be used to receive data packets from other physical devices.

[0125] Port 604 is an Ethernet switch port, which is an interface for connecting other physical devices, such as other switches, routers, hosts, and other physical devices. It includes physical ports and logical ports and can be used to send data packets to other physical devices.

[0126] In some embodiments, the ingress port 603 of the programmable switch receives a seed DNS query data packet generated by an electronic device. After processing by the programmable switch, an updated seed DNS query data packet and a DNS query data packet are obtained. The egress port 604 of the programmable switch sends the updated seed DNS query data packet to the designated DNS server. Through loopback technology, the egress port 604 of the programmable switch sends the DNS query data packet back to the ingress port 603 of the programmable switch, allowing it to re-enter the programmable switch.

[0127] Various implementations of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, application-specific integrated circuits (ASICs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs, i.e., this disclosure also proposes a computer program that, when executed by a processor, implements the attack drill method based on a programmable switch described in the above embodiments. This one or more computer programs can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0128] These computational programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term “machine-readable signal” refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0129] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0130] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, and blockchain networks.

[0131] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0132] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0133] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for attack and defense drills based on a programmable switch, characterized in that, The method includes: Obtain the seed Domain Name System (DNS) query data packet; Obtain the address information of the specified DNS server and the IP address information of the target host to be verified; The seed DNS query data packet is updated based on the address information of the specified DNS server and the IP address information of the target host to be verified, including: Replace the values ​​of the corresponding fields in the seed DNS query data packet with the address information of the specified DNS server and the IP address information of the target host to be verified; A DNS query packet is generated based on the updated seed DNS query packet, and DNS reflection amplification attack traffic is generated based on the updated seed DNS query packet and the DNS query packet to test the defense system of the target host. The seed DNS query data packet is generated in advance through the following steps: Construct a DNS query packet sample, wherein the query type in the DNS query packet sample is set to ANY; The QR field in the DNS query data packet sample is set to a first preset value, and the RD field in the DNS query data packet sample is set to a second preset value; A first field is added to the DNS query packet sample. The first field is used to identify the maximum User Datagram Protocol (UDP) packet size that the attack and defense exercise device can process.

2. The method as described in claim 1, characterized in that, The process of obtaining the seed DNS query data packet includes: Obtain the data packet to be processed; The data packet to be processed is parsed to obtain the port number, query request / response QR field, and expected recursion RD field in the data packet to be processed; If the port number in the data packet to be processed is determined to be a preset port number, and the QR field in the data packet to be processed is determined to be a first preset value and the RD field is determined to be a second preset value, then the data packet to be processed is determined to be the seed DNS query data packet.

3. The method as described in claim 1, characterized in that, The step of generating a DNS query data packet based on the updated seed DNS query data packet includes: The seed DNS query data packet header and the seed DNS query data packet body are cloned to obtain the cloned data packet header and its body, and the seed DNS query data packet and the cloned data packet header are concatenated and combined with their respective bodies. The cloned data packet is identified as the DNS query data packet.

4. The method as described in claim 1, characterized in that, The generation of DNS reflection amplification attack traffic based on the updated seed DNS query packets and the DNS query packets includes: The updated seed DNS query data packet is sent to the designated DNS server, wherein the seed DNS query data packet is used by the designated DNS server to return a DNS response data packet to the target host; The loopback technology based on the programmable switch is used to treat the DNS query data packet as a new seed DNS query data packet and return to execute the step of obtaining the address information of the specified DNS server and the IP address information of the target host to be verified, so as to generate DNS reflection amplification attack traffic.

5. The method as described in claim 1, characterized in that, The process of obtaining the address information of the specified DNS server and the IP address information of the target host to be verified includes: The address information of the initial specified DNS server is shifted to obtain the address information of the new specified DNS server. The initial IP address information of the target host to be tested is moduloed to obtain the new IP address information of the target host to be tested.

6. A defense and attack drill device based on a programmable switch, characterized in that, The device includes: The first acquisition module is used to acquire seed Domain Name System (DNS) query data packets; The second acquisition module acquires the address information of the specified DNS server and the IP address information of the target host to be verified. The update module is used to update the seed DNS query data packet according to the address information of the specified DNS server and the IP address information of the target host to be verified; The update module is specifically used for: Replace the values ​​of the corresponding fields in the seed DNS query data packet with the address information of the specified DNS server and the IP address information of the target host to be verified; The attack and defense exercise module is used to generate DNS query packets based on the updated seed DNS query packets, and generate DNS reflection amplification attack traffic based on the updated seed DNS query packets and DNS query packets, so as to test the defense system of the target host. The seed DNS query data packet is pre-generated through the following steps: Construct a DNS query packet sample, wherein the query type in the DNS query packet sample is set to ANY; The QR field in the DNS query data packet sample is set to a first preset value, and the RD field in the DNS query data packet sample is set to a second preset value; A first field is added to the DNS query packet sample. The first field is used to identify the maximum User Datagram Protocol (UDP) packet size that the attack and defense exercise device can process.

7. An attack and defense drill system, characterized in that, include: Electronic devices are configured to generate seed Domain Name System (DNS) query packets; A programmable switch configured to implement the method as described in any one of claims 1 to 5; Specifically, the electronic device is used for: Construct a sample DNS query packet; The QR field in the DNS query data packet sample is set to a first preset value, and the RD field in the DNS query data packet sample is set to a second preset value; A first field is added to the DNS query packet sample. This first field is used to identify the maximum size of the User Data Protocol (UDP) packets that the attack and defense exercise equipment can process.

8. A programmable switch, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1 to 5.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method as described in any one of claims 1 to 5.

Images