A novel UDP reflection amplification protocol identification method based on a combination of active and passive methods

Abstract

This invention provides a novel UDP reflection amplification protocol identification method based on a combination of active and passive detection. It combines active detection with traffic analysis, collecting known UDP reflection amplification features from the public internet by constructing a fingerprint database. A large number of samples are obtained by constructing reflection amplification request packets. After preprocessing, the sample data undergoes dual threshold detection verification using BAF and PAF. This detection method is then applied to mine real-world network traffic, using a multi-factor feature matching method based on Port and Payload to filter out novel reflection amplification protocols and triggering methods that meet the criteria. After replay verification, the newly discovered fingerprints are added to the fingerprint database. This invention's novel UDP reflection amplification protocol identification method, based on a combination of active and passive detection, proposes a dual threshold judgment and multi-factor feature matching approach for detecting datasets and real-world network traffic. The proposed method exhibits good real-time performance and versatility, and discovers the potential reflection amplification capability of the QUIC protocol, demonstrating significant detection effectiveness.

Description

Technical Field

[0001] This invention belongs to the technical field of information security, and specifically relates to a novel UDP reflection amplification protocol identification method based on a combination of active and passive methods. Background Technology

[0002] UDP is a connectionless protocol that typically transmits data directly without performing security checks on the source request. Exploiting this characteristic, attackers can easily forge the source address in a UDP request packet to the address of the attacked host, then send request packets to servers offering certain internet services. Several times the number of request packets are then sent to the attacked host, exhausting its bandwidth and achieving a denial-of-service attack – thus realizing a UDP reflection amplification attack. Rossow et al. proposed the concepts of BAF (Bandwidth Amplification Factor) and PAF (Packet Amplification Factor) as evaluation criteria for reflection amplification, and found that 14 popular UDP-based network protocols, including NTP, CharGen, and SSDP, are suitable for reflection-based DDoS attacks. Li Gang discussed the feasibility of scanning detection based on flow records. Based on this, he designed a port-matching-based horizontal scan detection algorithm using flow records as the analysis data source. This algorithm was deployed on the NBOS platform and detected a large number of TCP SYN and UDP horizontal scans. Lu Xuanting et al. proposed a method based on traffic analysis to discover unpublished protocols with UDP reflection amplification potential. They screened traffic samples that met the reflection amplification characteristics from daily network traffic and then verified the repeatability of the samples by traffic replay.

[0003] However, current research has the following problems: 1. Current research focuses on UDP protocols such as NTP, CharGen, and SSDP, which were discovered earlier, and lacks research on newly discovered UDP reflection amplification protocols in recent years; 2. Current research treats BAF as a single reflection amplification evaluation standard, ignoring BAF, and the traditional BAF calculation method is not reasonable enough; 3. Current research focuses on the detection of known protocols, and there is insufficient research on discovering new UDP reflection amplification protocols through detection. Summary of the Invention

[0004] To address the problems existing in the above research, this invention provides a novel UDP reflection amplification protocol identification method based on a combination of active and passive methods.

[0005] The solution adopted by this invention to solve its technical problem is: a novel UDP reflection amplification protocol identification method based on a combination of active and passive methods, including a fingerprint database construction module, a sample acquisition module, a data preprocessing module, a threshold detection module, a feature matching module, and a replay verification module. The fingerprint database construction module dynamically learns known UDP reflection amplification types and characteristics, continuously updating the database content. The sample acquisition module acquires IP fragmentation response packets for IoT reflection amplification protocols. The sample acquisition module collects traffic reflecting reflection amplification traffic characteristics. The data preprocessing module filters out UDP reflection amplification traffic that meets the conditions, improving data processing efficiency. The threshold detection module provides a BAF calculation method and uses a dual threshold detection method of BAF and PAF to improve the accuracy of UDP reflection amplification detection. The feature matching module compares the Port and Payload features of UDP reflection amplification traffic that meets the conditions with the corresponding features in the fingerprint database to determine whether the UDP reflection amplification traffic that meets the conditions is a novel reflection amplification protocol and triggering method traffic. Finally, the replay verification module replays and verifies the filtered novel reflection amplification protocol and triggering method traffic that meets the conditions, reducing the false alarm rate.

[0006] The UDP reflection amplification multi-source fingerprint database uses a dynamic fingerprint learning approach to continuously collect new fingerprint features through the exposure of reflective DDoS events and disclosures by security teams. These new fingerprint features are then amplified through reflection and added to the fingerprint database.

[0007] The traffic sources for the sample acquisition module are divided into two parts. The first is traffic actively detected, which uses OSINT (open source network intelligence) to search and obtain a large number of IP address resources for different protocols and services. The script automatically sends request packets with payloads to the corresponding IPs and then saves the interactive traffic as a pcap file. The second is traffic captured in the real network, which uses traffic behavior observation systems deployed on telecommunications backbone network nodes and campus network backbone network nodes to obtain massive traffic data in the Internet.

[0008] The traffic generated by the sample acquisition module is divided into 100M files and saved to the system's data preprocessing module. For a single file, the file is loaded using the scapy library. Non-UDP traffic and traffic with severe packet loss are removed. The data is grouped and filtered according to the UDP stream pattern, and the stream data is processed to extract the field information of each data packet, including time, IP, port, payload, and byte length.

[0009] Threshold detection employs a sliding time window algorithm, using the time of a single request message as a benchmark. The communication traffic between the source IP and destination IP within the Δt time interval is considered as a single "interaction" traffic, with all forward traffic considered as request traffic and all corresponding reverse traffic considered as response traffic. The data obtained from the data preprocessing module is added to the same group. Based on the information obtained from the data preprocessing module, the total length of the request message, the total length of the response message, the number of request messages, and the number of response messages are calculated. BAF and PAF are calculated using formulas (1) and (2).

[0010]

[0011]

[0012] A dual threshold determination is performed on BAF and PAF. Based on the IoT reflection amplification characteristics, the BAF threshold is set to 3 and the PAF threshold is set to 2. If neither BAF nor PAF reaches the threshold standard, it means that the traffic does not meet the reflection amplification characteristics and can be discarded. If either BAF or PAF reaches the threshold, it means that the traffic meets the reflection amplification characteristics and is determined to be reflection amplified traffic.

[0013] The feature matching module uses a port-payload approach. It performs multi-factor feature matching on traffic that meets the dual threshold detection criteria by amplifying fingerprints provided by a multi-source fingerprint database via UDP reflection. The final result is categorized into three cases: 1. Both port and payload match successfully, indicating the traffic features are already in the fingerprint database and are known reflection amplification traffic, which can be discarded; 2. Port matches successfully, but payload fails to match, indicating the traffic uses a known reflection amplification protocol but with a new triggering method; 3. Port fails to match, regardless of payload matching, indicating the traffic uses a novel reflection amplification protocol. Traffic in cases 2 and 3 is saved for further analysis and evaluation by researchers, and then imported into the replay verification module for verification.

[0014] The constructed data packets with novel reflection amplification protocol and triggering method features are replayed for verification. The traffic is then subjected to secondary detection. Request and response messages are compared and observed. BAF and PAF are calculated. A dual threshold detection method is used to measure the reflection amplification after replay. Finally, the traffic fingerprints that exhibit reflection amplification after replay are added to the fingerprint database as newly discovered features.

[0015] The beneficial effects of this invention are as follows: This invention constructs a request message with a reflection amplification payload to probe and verify node resources collected on the network, identifies effective amplifiers, and extracts reflection amplification traffic. Then, it detects and identifies UDP streams through dual threshold judgment and multi-feature matching. Simultaneously, this method is applied to filter and replay real-world network traffic for verification, ultimately discovering potential novel reflection amplification protocols and triggering methods.

[0016] This invention constructs a dataset containing various newly discovered reflection amplification protocols in recent years, such as OpenVPN and WS-Discovery, which is beneficial for summarizing and sorting out the latest reflection amplification traffic characteristics; it proposes a new BAF calculation method to solve the IP fragmentation problem in order to cope with future new reflection amplification detection; at the same time, it proposes a new UDP reflection amplification protocol identification method based on active and passive combination, which can realize the detection of known and unknown UDP reflection amplification traffic. Attached Figure Description

[0017] Figure 1 It is the bandwidth amplification factor for each protocol.

[0018] Figure 2 This is the system architecture diagram of the present invention. Detailed Implementation

[0019] Example 1: Current reflection amplification attacks are mainly based on the UDP protocol. Although the TCP three-way handshake hinders the implementation of reflection amplification, some TCP protocols can still be used for reflection amplification attacks. The identification methods for reflection amplification protocols can be mainly divided into the following three types: identification methods based on manual protocol analysis, identification methods based on real-world network traffic capture analysis, and identification methods based on fuzz testing.

[0020] Manual protocol analysis was once the most mainstream method for identifying reflection amplification. Different analysis strategies can be adopted for different protocols and public services. For network service protocols, the corresponding RFC documents and open-source code implementations can be studied. Many classic reflection amplification protocols were discovered by reading the message formats defined in the RFC documents, and reflection amplification can be triggered by constructing operations such as query requests. For game servers, possible amplification vectors can be found in the public API documents provided by the game vendors.

[0021] Protocols such as ICMP, TCP, UDP, DNS, SNMP, and HTTP possess the potential for reflection amplification under DDoS attack models that spoof source addresses, allowing attackers to exploit design flaws in protocol fields to generate amplified traffic. However, with the proliferation of the Internet of Things (IoT), attackers have increasingly used protocol vulnerabilities in IoT devices to launch reflection amplification attacks. Analyzing protocol design flaws is too time-consuming for researchers, and relying solely on manual protocol analysis to identify reflection amplification protocols is no longer sufficient for current research needs.

[0022] With the increasing number of real-world reflection amplification attacks in recent years, DDoS traffic capture and analysis has become the mainstream method for identifying reflection amplification protocols. When a hacker uses forged reflection requests to attack a monitoring system, the monitoring nodes report the attack event to the security posture center in real time, collect the attack traffic, and extract the attack request commands. This helps security personnel review unknown reflection amplification attacks and perform replay verification.

[0023] Using identification methods based on DDoS traffic capture and analysis, several new types of reflection attacks can be identified, and various IoT reflection amplification protocols have been discovered in recent years. Many security companies and teams have applied this technology for analysis, research, and security alerts to improve their resistance to DDoS reflection attacks.

[0024] There are many types of reflection amplification attacks, and the payloads of different reflection attacks vary greatly. Many new types of reflection amplification remain difficult to identify. In recent years, fuzzing methods have emerged to deeply analyze router nodes, IoT devices, and public services. Fuzzing algorithms generate a large number of reflection request packets, and for reflection attacks that capture a large number of response packets, they can accurately generate trigger payloads.

[0025] Fuzzy testing-based identification methods have demonstrated that the risks of reflection amplification DDoS attacks have been underestimated in the past. Using such methods can help researchers discover more reflection amplification protocols and new reflection amplification query patterns. While current research can accurately capture reflection amplification attack traffic and reconstruct attack scenarios, it lacks research on novel UDP reflection amplification protocols and cannot proactively discover new UDP reflection amplification protocols through traffic analysis. Furthermore, the calculation methods for reflection amplification are not sufficiently reasonable.

[0026] Based on this, in order to solve the above problems, the present invention proposes a UDP reflection amplification protocol identification method based on a combination of active and passive detection. It combines active detection with traffic analysis, collects known UDP reflection amplification features on the public network by constructing a fingerprint database, obtains a large number of samples by constructing reflection amplification request packets, performs BAF plus PAF dual threshold detection and verification on the sample data after preprocessing, and uses this detection method to mine real network traffic. It uses a multi-feature matching method of Port plus Payload to screen out new reflection amplification protocols and triggering methods that meet the conditions. After replay verification, the newly discovered fingerprints are added to the fingerprint database.

[0027] BAF and PAF are units of measurement for the amplification factor of a reflection attack, and their calculation methods are shown in formulas (1) and (2):

[0028]

[0029]

[0030] Reflection amplification can be divided into traffic multiplication attacks and payload amplification attacks. Traffic multiplication attacks amplify the number of data packets, while payload amplification amplifies the size of the data packets. From the attacker's perspective, a small query is sent, but a large response is received. Figure 1 As shown, all represents the average BAF of all amplifiers, and 50% and 10% represent the average BAF of the amplifiers used with the most severe 50% or 10% of the amplifiers.

[0031] Because newly discovered UDP reflection amplification request packets have small payloads in recent years, some even being empty, the original BAF calculation method did not include Ethernet frames, IP headers, and UDP header fields in the packet payload, which easily led to errors, and the final result could not objectively reflect the reflection amplification effect of each protocol. At the same time, some protocols have large single reply packets, resulting in IP fragmented packets, which are ignored by commonly used port matching methods. Furthermore, experiments have shown that some protocols involve multi-packet triggering issues, meaning that multiple request packets may be sent during a single UDP reflection amplification process. All of these problems pose significant challenges to the original BAF calculation method. Therefore, to accurately and objectively reflect the effect of reflection amplification, this invention applies a sliding time window algorithm to the BAF calculation formula and adopts a full request and response packet payload approach, redefining the BAF calculation method to solve the above problems.

[0032] Previous reflection amplification attacks were almost all payload amplification attacks, and their forms were relatively simple. Therefore, previous research results used BAF as the sole evaluation standard for reflection amplification. However, many newly discovered IoT reflection amplification protocols in recent years have the characteristics of traffic multiplication attacks, that is, a hacker sends a request message and returns multiple response messages. In order to solve this problem, this invention introduces PAF into the reflection amplification calculation index, which expands the detection of this form of reflection amplification, traffic multiplication attack.

[0033] This invention proposes a novel UDP reflection amplification protocol identification method based on a combination of active and passive methods. This method comprises six modules: a fingerprint database construction module, a sample acquisition module, a data preprocessing module, a threshold detection module, a feature matching module, and a replay verification module. Figure 2 As shown, the fingerprint database construction module dynamically learns fingerprints from known UDP reflection amplification types and characteristics, continuously updating the database content; the sample acquisition module targets newly discovered IoT reflection amplification protocols in recent years and acquires IP fragmentation response packets, making the collected traffic more representative of reflection amplification traffic characteristics; the data preprocessing module filters out UDP reflection amplification traffic that meets the conditions, improving the processing efficiency of massive amounts of data; the threshold detection module proposes a novel BAF calculation method and adopts a dual threshold detection method of BAF and PAF, improving the accuracy of UDP reflection amplification detection; the feature matching module compares the Port and Payload features of UDP reflection amplification traffic that meets the conditions with the corresponding features in the fingerprint database, thereby determining whether the traffic belongs to a new type of reflection amplification protocol and triggering method. The replay verification module replays and verifies the filtered new type of reflection amplification protocol and triggering method traffic that meets the conditions, reducing the false alarm rate.

[0034] The following is a further detailed description of each module:

[0035] Fingerprint database construction module: In searching for new UDP reflection amplification methods, this approach moves beyond traditional public services and explores all UDP services exposed on the public network with a certain scale as reflection sources. Through reviewing various resources, over 50 types of publicly available UDP reflection amplification methods were discovered, including various protocols, services, devices, and games, some of which have multiple triggering methods. Therefore, this invention constructs a multi-source fingerprint database for UDP reflection amplification. It employs dynamic fingerprint learning, continuously collecting new fingerprint features through various methods such as exposure of reflective DDoS events and disclosures by security teams. Attack scenarios are reproduced in a test environment, and once the method is confirmed to have reflection amplification capabilities, new features are added to the fingerprint database.

[0036] Sample Acquisition Module: Since the principles of UDP reflection attacks differ across protocols, the corresponding traffic detection algorithms must also be adjusted. Therefore, the sample acquisition phase requires collecting representative traffic with different characteristics. This invention selects four IoT reflection amplification protocols discovered in recent years: OpenVPN, WS-Discovery, CoAP, and Ubiquiti. The response messages of some of these protocols contain IP fragmented packets, representing the latest UDP reflection amplification traffic characteristics. The traffic sources for the sample acquisition module are divided into two parts: first, actively detected traffic. This invention uses OSINT (Open Source Network Intelligence) to search and obtain a large number of IP address resources for different protocols and services, and uses scripts to automatically send request messages with payloads to the corresponding IPs, saving the interactive traffic as a pcap file; second, traffic captured in the real network. This invention deploys traffic behavior observation systems on telecommunications backbone network nodes and campus network backbone network nodes to obtain massive amounts of traffic data from the Internet.

[0037] Data Preprocessing Module: Due to the large amount of irrelevant data such as TCP packets mixed in with the massive traffic, data preprocessing is necessary. To reduce device load and improve data processing efficiency, the traffic generated by the sample acquisition module is divided into 100MB files and sent to the system's data preprocessing module. For a single file, the file is loaded using the scapy library, non-UDP traffic and traffic with severe packet loss are removed, and the data is grouped and filtered according to the UDP stream pattern. The stream data is then processed to extract fields such as time, IP, port, payload, and byte length of each data packet.

[0038] Threshold detection module: The UDP protocol does not require establishing a connection before data transmission and does not include a packet ordering mechanism. This means that UDP packets may encounter varying delays and packet loss during network transmission, potentially causing packets to arrive at the receiver in different orders. Furthermore, the UDP protocol lacks retransmission mechanisms, congestion control, and flow control. Therefore, when network congestion occurs during data transmission, packet loss or packet overlap during transmission can easily occur, further increasing the possibility of out-of-order delivery.

[0039] Therefore, the packet ordering problem of the UDP protocol poses a significant challenge to the computation of reflection amplification. This invention employs a sliding time window algorithm, using the time of a single request packet as a benchmark. Within a time range of Δt, it assumes that m packets are requested (m≥1), and the length of each request packet is len(Rq). i ), where i represents the i-th request message; n response messages (n≥1), each with a length of len(Rp) j), j represents the j-th response message, and the calculation expression for BAF is defined as shown in formula (3):

[0040]

[0041] The communication traffic between the source IP and destination IP within the Δt time interval is considered a single "interaction" traffic. Forward traffic is considered request traffic, and corresponding reverse traffic is considered response traffic. Data obtained from the data preprocessing module is added to the same group. Based on the information from the data preprocessing module, the total length of request messages, the total length of response messages, the number of request messages, and the number of response messages are calculated. BAF and PAF are calculated using the newly proposed formula. A dual threshold determination is applied to BAF and PAF. Based on the newly discovered IoT reflection amplification characteristics, the BAF threshold is set to 3, and the PAF threshold is set to 2. The final result is divided into two different cases: 1. If neither BAF nor PAF reaches the threshold standard, the traffic does not meet the reflection amplification characteristics and can be discarded; 2. If either BAF or PAF coefficient reaches the threshold, the traffic meets the reflection amplification characteristics and is determined to be reflection amplified traffic. Finally, the traffic in the second case is imported into the feature matching module for subsequent detection. The threshold detection process is described in Algorithm 1.

[0042] Algorithm 1: Dual Threshold Determination Algorithm

[0043] Input: UdpStream

[0044] Output: null

[0045]

[0046]

[0047] Feature Matching Module: Currently, UDP reflection amplification attacks are triggered by forging IP addresses and sending carefully crafted payloads to a specific port of the reflection amplifier, thereby achieving the reflection amplification effect. This invention uses both port and payload methods, employing fingerprints provided by a multi-source fingerprint database for UDP reflection amplification to perform multi-feature matching on traffic meeting the dual threshold detection criteria. The final result is categorized into three cases: 1. Both port and payload match successfully, indicating the traffic characteristics are already in the fingerprint database, representing known reflection amplification traffic, which can be discarded; 2. Port matches successfully, payload fails to match, indicating the traffic uses a known reflection amplification protocol, but with a new triggering method; 3. Port fails to match, regardless of payload matching, indicating the traffic uses a novel reflection amplification protocol. Finally, traffic from cases 2 and 3 is saved for further analysis and evaluation by researchers, and then imported into the replay verification module for verification. The feature matching process is described in Algorithm 2.

[0048] Algorithm 2 Multivariate Feature Matching Algorithm

[0049] Input: SelectedStream

[0050] Output: New_Method or New_Protocol

[0051]

[0052] Replay Verification Module: Replay attacks, also known as replay attacks or rewind attacks, refer to attackers sending a packet that the target host has already received to deceive the system. This is primarily used in the authentication process to compromise the accuracy of authentication. Due to the inherent uncertainties in real-world network traffic, to minimize false positives and discover more authentic new UDP reflection amplification protocols, this invention borrows this approach to replay and verify pre-constructed data packets with characteristics of the new reflection amplification protocol and triggering method. This is equivalent to performing a secondary inspection of the traffic. By comparing and observing request and response messages, calculating BAF and PAF, and using a dual threshold detection method to measure the reflection amplification after replay, the fingerprint of the traffic that has undergone reflection amplification after replay is added to the fingerprint database as a newly discovered feature.

[0053] The novel UDP reflection amplification protocol identification method proposed in this invention, based on a combination of active and passive detection, obtains the latest UDP reflection amplification dataset through active detection. Combined with research on reflection-type DDoS detection methods, a dual threshold judgment and multi-feature matching method is proposed to detect the dataset and real network traffic. Through experimental evaluation, the method proposed in this invention has good real-time performance and versatility, and has discovered the potential reflection amplification capability of the QUIC protocol, with significant detection effect.

Claims

1. A novel UDP reflection amplification protocol identification method based on a combination of active and passive methods, characterized in that, The system includes a fingerprint database construction module, a sample acquisition module, a data preprocessing module, a threshold detection module, a feature matching module, and a replay verification module. The fingerprint database construction module dynamically learns known UDP reflection amplification types and characteristics, continuously updating the database. The sample acquisition module acquires IP fragmentation response packets for IoT reflection amplification protocols. The sample acquisition module collects traffic data to reflect reflection amplification traffic characteristics. The data preprocessing module filters out UDP reflection amplification traffic that meets the criteria, improving data processing efficiency. The threshold detection module provides a BAF calculation method and employs a dual threshold detection method of BAF and PAF to improve the accuracy of UDP reflection amplification detection. The feature matching module compares the Port and Payload features of UDP reflection amplification traffic that meets the criteria with corresponding features in the fingerprint database to determine whether the UDP reflection amplification traffic meets the criteria is traffic from a new reflection amplification protocol and triggering method. Finally, the replay verification module replays and verifies the filtered traffic from new reflection amplification protocols and triggering methods that meet the criteria, reducing the false alarm rate. The feature matching module uses a Port and Payload approach. It amplifies the fingerprints provided by the multi-source fingerprint database through UDP reflection and performs multi-feature matching on traffic that meets the dual threshold detection criteria. The final result is divided into three different cases:

1. Both Port and Payload are successfully matched, which means that the traffic features are already in the fingerprint database. It is a known reflected amplified traffic and can be discarded.

2. If the port matches successfully but the payload fails to match, it means that the traffic is a known reflection amplification protocol, but it is a new triggering method.

3. Port matching failure, regardless of whether the payload matches, indicates that the traffic is a new type of reflection amplification protocol; traffic in cases 2 and 3 will be saved for further analysis and judgment by researchers, and imported into the replay verification module for verification.

2. The novel UDP reflection amplification protocol identification method based on a combination of active and passive methods according to claim 1, characterized in that, The UDP reflection amplification multi-source fingerprint database uses a dynamic fingerprint learning approach to continuously collect new fingerprint features through the exposure of reflective DDoS events and disclosures by security teams. These new fingerprint features are then amplified through reflection and added to the fingerprint database.

3. The novel UDP reflection amplification protocol identification method based on a combination of active and passive methods according to claim 1, characterized in that, The traffic sources for the sample acquisition module are divided into two parts. The first is traffic actively detected, which obtains a large number of IP address resources for different protocols and services through OSINT search, and automatically sends request packets with payloads to the corresponding IPs through scripts, and then saves the interactive traffic as a pcap file. The second is traffic captured in the real network, which obtains massive traffic data in the Internet by deploying traffic behavior observation systems at telecommunications backbone network nodes and campus network backbone network nodes.

4. The novel UDP reflection amplification protocol identification method based on a combination of active and passive methods according to claim 1, characterized in that, The traffic generated by the sample acquisition module is divided into 100M files and saved to the system's data preprocessing module. For a single file, the file is loaded using the scapy library. Non-UDP traffic and traffic with severe packet loss are removed. The data is grouped and filtered according to the UDP stream pattern, and the stream data is processed to extract the field information of each data packet, including time, IP, port, payload, and byte length.

5. The novel UDP reflection amplification protocol identification method based on a combination of active and passive methods according to claim 1, characterized in that, Threshold detection employs a sliding time window algorithm, using the time of a single request message as a benchmark, and... The communication traffic between the source IP and destination IP within the time interval is considered as a single "interaction" traffic. The forward traffic is considered as request traffic, and the corresponding reverse traffic is considered as response traffic. The data obtained by the data preprocessing module is added to the same group. The total length of the request message, the total length of the response message, the number of request messages, and the number of response messages are calculated based on the information obtained by the data preprocessing module. BAF and PAF are calculated using formulas (1) and (2): ； ； Where len(UDP payload)amplifier to victim is the total length of the response message; len(UDP payload)attacker to amplifier is the total length of the request message; number of packets amplifier to victim is the number of response messages; and number of packets attacker to amplifier is the number of request messages. A dual threshold determination is performed on BAF and PAF. Based on the IoT reflection amplification characteristics, the BAF threshold is set to 3 and the PAF threshold is set to 2. If neither BAF nor PAF reaches the threshold standard, it means that the traffic does not meet the reflection amplification characteristics and can be discarded. If either BAF or PAF reaches the threshold, it means that the traffic meets the reflection amplification characteristics and is determined to be reflection amplified traffic.

6. The novel UDP reflection amplification protocol identification method based on a combination of active and passive methods according to claim 1, characterized in that, The constructed data packets with novel reflection amplification protocol and triggering method features are replayed for verification. The traffic is then subjected to secondary detection. Request and response messages are compared and observed. BAF and PAF are calculated. A dual threshold detection method is used to measure the reflection amplification after replay. Finally, the traffic fingerprints that exhibit reflection amplification after replay are added to the fingerprint database as newly discovered features.

Images