Method for defending against tcp protocol abuse based on ann and heuristic rules

Abstract

The application discloses a kind of data plane based on ANN and heuristic rule's TCP protocol abuse defense method, belong to computer network security field.The method includes: for optimistic ACK, select ACK sequence number step as feature, after collecting feature data, by ANN, flow is detected as normal flow and suspicious flow, then using heuristic switch rule to carry out packet loss processing to suspicious flow.For ECN abuse, select switch export queue length as feature, after collecting feature data, by ANN, flow is detected as flow under normal condition and flow under congestion condition, finally using the packet processing logic based on data plane to modify message processing to flow, so that flow meets the rules of ECN.The method proposed in the application can prevent the two types of TCP protocol abuse, and is an effective TCP protocol abuse defense method.

Description

Technical Field

[0001] This invention belongs to the field of computer network security, specifically relating to a defense method against TCP protocol abuse based on ANN and heuristic rules. Background Technology

[0002] TCP protocol abuse refers to attacks that exploit vulnerabilities in the TCP protocol, consuming the resources of the attacked target and causing a decline in network performance. TCP protocol abuse includes various types of attacks, such as SYN flooding attacks, TCP sequence number inference attacks, and Denial of Service (DoS) attacks.

[0003] Optimistic ACK attacks are a form of TCP protocol abuse that exploits the receiver-controlled rate of congestion in TCP. Attackers send acknowledgments for segments they haven't yet received, misleading the sender into believing network conditions are better than they actually are, thus increasing the sending rate. This malicious TCP connection exhausts the bandwidth of intermediate links, leading to a decline in network performance.

[0004] ECN abuse is a form of TCP protocol abuse that exploits the characteristics of the ECN mechanism. Under normal circumstances, when congestion occurs, the receiver should set the ECE flag to 1. Therefore, one form of ECN abuse involves the receiver notifying the sender of congestion, but then failing to change the ECE flag, preventing the sender from reducing its transmission rate. This causes the ECN mechanism to fail, resulting in network performance degradation.

[0005] As an emerging network architecture, SDN decouples the network layer data and control plane in traditional TCP / IP networks, reducing the complexity of the data plane, enriching the functionality of the control plane, and providing excellent programmability, greatly facilitating application deployment and innovation in the field of computer networks. The programmable data plane further decouples the data plane from network devices, thereby meeting ever-changing network requirements.

[0006] Currently, most defenses against optimistic ACK attacks and ECN abuse are deployed in traditional networks, and these methods generally require modifications to the TCP protocol or terminal hosts, making them difficult to deploy in practice. Research projects on defending against optimistic ACK attacks and ECN abuse in the programmable data plane are scarce; therefore, deploying defense methods in the programmable data plane is of significant research value.

[0007] This invention proposes a defense method based on ANN and heuristic rules in the data plane to address two forms of TCP protocol abuse. For optimistic ACK attacks, a program for collecting traffic feature data is loaded into the programmable switch, and the collected feature data is used to train the ANN. An optimistic ACK attack detection model is deployed in the upstream programmable switch of the bottleneck link. The constructed optimistic ACK attack detection model is used to detect each flow, and the output of the detection model determines whether an optimistic ACK attack exists in the flow. When a flow is determined to be suspicious, heuristic rules are used to compare the expected acknowledgment number with the actual acknowledgment number, and based on this, an optimistic ACK flow is identified and added to a packet loss list for packet loss processing, thus mitigating the optimistic ACK attack in a timely manner. For ECN abuse, a program for collecting traffic feature data is loaded into the programmable switch, and the collected feature data is used to train the ANN. An ECN abuse detection model is deployed in the data plane, and the constructed ECN abuse detection model is used to detect each flow. The output of the detection model determines whether the flow is in a normal or congested state. Heuristic rules are used to process flows in normal or congested states separately, making them conform to ECN rules, thereby mitigating ECN abuse. The method proposed in this invention can defend against optimistic ACK attacks and ECN abuse in programmable networks, with high accuracy and recall. Furthermore, this method has better mitigation effects, restoring more throughput and congestion windows, making it an effective method for defending against optimistic ACK attacks and ECN abuse. Summary of the Invention

[0008] This invention addresses the shortcomings of existing defense methods, such as inaccurate evaluation metrics and poor recovery performance. It proposes a TCP protocol abuse defense method based on ANN and heuristic rules, using optimistic ACK attacks and ECN abuse as examples. For optimistic ACK attacks, the acknowledgment numbers from the receiver's initial and final packets within the detection window are first collected. The difference between these two numbers is used to obtain the ACK sequence number step size. After data sampling and processing, an artificial neural network is used to classify flows into normal and suspicious categories. Suspicious flows are then further evaluated using heuristic rules, and flows identified as optimistic ACKs are dropped. For ECN abuse, the length of the switch's egress queue is collected using P4's built-in metadata. An artificial neural network is used to classify flows into normal and congested categories, and heuristic rules are then used to modify packets within the flows. Compared to existing defense methods, this method offers more accurate evaluation metrics and stronger robustness.

[0009] The technical solution adopted by this invention to achieve the above objectives is as follows: This TCP protocol abuse defense method mainly includes three steps: data collection, attack detection, and attack mitigation.

[0010] 1. Optimistic ACK Attack Data Collection. Based on the characteristics of optimistic ACK attacks, the ACK sequence number step size was selected as a feature for the pre-training of the optimistic ACK attack detection model. Analysis of the data confirmation status of streams with optimistic ACK attacks and normal streams revealed that streams with optimistic ACK attacks confirmed more data within the same time frame than normal streams. Therefore, the ACK sequence number step size can determine whether an optimistic ACK attack exists in the stream. The ACK sequence number step size is defined as the amount of data confirmed by the receiver within a single detection window. The formula for calculating the ACK sequence number step size is (1): step = ack last -ack first (1) Where step is the ACK sequence number step size; ack last It is the acknowledgment number in the last message received by the receiver in the detection window; ack first It is the acknowledgment number in the initial message from the receiver in the detection window.

[0011] 2. Optimistic ACK Attack Detection. The optimistic ACK detection model uses a neural network to classify flows into two categories: normal flows and suspicious flows. In the upstream switch of the bottleneck link, label 1 represents that the flow is a suspicious flow, and label 0 represents that the flow is a normal flow, thereby realizing the detection of optimistic ACK attacks.

[0012] 3. Optimistic ACK Attack Mitigation. Establish a packet loss list. For all suspicious traffic, re-evaluate the attack. In cases of optimistic ACK attacks, the attacker sends ACK packets prematurely, resulting in a larger number of acknowledgments than normal. Calculate the expected acknowledgment number by taking the sequence number and payload of the sender's packet. Compare the expected acknowledgment number with the actual acknowledgment number in the receiver's packet. If the actual acknowledgment number is greater than the expected acknowledgment number, the flow is identified as an optimistic ACK attack flow and added to the packet loss list for discarding.

[0013] 4. ECN Abuse Data Collection. Based on the characteristics of ECN abuse, the length of the switch egress queue was selected as a feature for pre-training the ECN abuse detection model. By analyzing the state of the switch egress queue under congestion and normal conditions, it was found that more packets wait for forwarding in the switch during congestion. Therefore, the length of the switch egress queue can quantify the degree of network congestion and determine the state of flows.

[0014] 5. ECN Abuse Detection. The ECN abuse detection model uses an artificial neural network to classify flows into two categories: normal flows and congested flows. If the classification result is 0, the flow is determined to be a normal flow; if the classification result is 1, the flow is determined to be a congested flow, thereby achieving ECN abuse detection.

[0015] 6. ECN Abuse Mitigation. A control state transition method is used to control the switch's behavior. There are two states: secure and congested. When a link is congested and the receiver exhibits inappropriate behavior, the switch takes mitigation measures and transitions from the secure state to the congested state. When the switch is in the secure state, the ECE flag in the receiver's packets is set to 0; when the switch is in the congested state, the ECE flag in the receiver's packets is set to 1. Beneficial effects

[0016] This TCP protocol abuse defense method exhibits high detection recall against optimistic ACK attacks and ECN abuse, and outperforms existing methods in the programmable data plane in terms of throughput and congestion window recovery. Furthermore, the algorithm boasts accurate evaluation metrics and strong robustness. Therefore, this detection method is suitable for defending against TCP protocol abuse. Attached Figure Description

[0017] Figure 1 A flowchart illustrating a defense method against an optimistic ACK attack.

[0018] Figure 2 This is a schematic diagram illustrating the effectiveness of the optimistic ACK attack defense method.

[0019] Figure 3 This is a flowchart illustrating a defense method against ECN abuse.

[0020] Figure 4 This is a diagram illustrating the effects of ECN abuse defense methods. Detailed Implementation

[0021] The invention will be further described below with reference to the accompanying drawings.

[0022] Figure 1 This is a flowchart illustrating a defense method against optimistic ACK attacks. After collecting ACK sequence number step size data, an artificial neural network is used to classify flows into normal and suspicious flows. Suspicious flows are then added to a packet loss list. The expected acknowledgment number of the packets received by the receiver in this flow is calculated. If the expected acknowledgment number is greater than the actual acknowledgment number, the flow is identified as an optimistic ACK attack flow and its packets are dropped. Deploying the artificial neural network to the programmable data plane mainly includes the following two steps:

[0023] 1.1 Normalized features in artificial neural networks are implemented using longest prefix matching flow table entries. Specifically, the table structure in the programmable data plane stores flow rules in the form of tuples <match, action>, and each flow table entry stores a mask corresponding to a prefix. Each prefix used for matching represents the input value of a feature within a range, and the output when the prefix is ​​matched is (2): Where y is the output when the prefix is ​​matched; x i x i+1 These are the left and right boundary endpoints of the interval, respectively; f(x) i ), f(x) i+1 These are the true normalized values ​​corresponding to the left and right boundaries, respectively.

[0024] 1.2 The formula for the activation function can be expressed as (3): Here, x represents the neuron input, and g(x) represents the neuron output. It provides nonlinear modeling capabilities for neural networks. For the activation function, since its input values ​​can be negative, a piecewise approach is used. For the activation function g(x), the domain of its input x is (-∞, +∞), and the range of input x is divided into several sub-intervals {(-∞, x0], (x0, x1], ..., (x... i ,x i+1 ],…,(x t ,+∞)}. And for a subinterval (x,+∞) of a single input x. i ,x i+1 The corresponding output is:

[0025] Figure 2 (a) Comparison of throughput recovery for different optimistic ACK attack mitigation methods for programmable data planes. Figure 2 (b) Comparison of congestion window recovery for different optimistic ACK attack mitigation methods for programmable data planes. It can be seen that the method using heuristic rules has higher throughput recovery and congestion window recovery rates. The recovery rates remain very similar even with varying numbers of attackers.

[0026] Figure 3 This is a flowchart illustrating a defense method against ECN abuse. After collecting characteristic data such as the switch egress queue length, an artificial neural network is used to classify flows into two categories: flows under normal conditions and flows under congestion conditions. Then, based on the flow detection results, the flag bits in the packets are modified to conform to ECN rules, thereby mitigating ECN abuse.

[0027] Figure 4(a) Comparison of throughput recovery for different ECN abuse mitigation methods for programmable data planes. Figure 4 (b) Comparison of congestion window recovery for different ECN abuse mitigation methods in the programmable data plane. It can be seen that the method using heuristic rules has a higher throughput recovery rate and congestion window recovery rate. The recovery rates remain very similar even with varying numbers of attackers.

Claims

1. A TCP protocol abuse defense method based on ANN and heuristic rules, characterized in that, Here, ANN refers to Artificial Neural Network, and TCP protocol abuse refers to attacks that exploit vulnerabilities in the TCP protocol, causing a decline in network performance. Optimistic ACK attacks and explicit congestion notification (ECN) abuse are two forms of TCP protocol abuse. Defending against TCP protocol abuse in the programmable data plane does not require modification of the terminal host or the protocol. The defense method specifically includes the following steps: Optimistic ACK attack and defense process: S1. Select the ACK sequence number step size as a feature in the programmable data plane, where the ACK sequence number step size is defined as the amount of data acknowledged by the receiver within a single detection window; load the program that collects traffic feature data into the programmable switch, append the collected features as fields of the custom protocol header to the cloned data packets, and then send them to the switch that has deployed the detection model; then parse the protocol header fields of these data packets to obtain the feature set used to train the optimistic ACK attack detection model; S2. The detection model uses an artificial neural network to classify flows into two categories: normal flows and suspicious flows. In the upstream switch of the bottleneck link, label 1 represents that the flow is a suspicious flow and label 0 represents that the flow is a normal flow, thereby realizing the detection of optimistic ACK attacks. S3. To mitigate optimistic ACK attacks, a packet loss list is established. For all suspicious traffic, a second judgment is made. In the case of an optimistic ACK attack in the flow, the attacker sends ACK packets in advance, resulting in a larger number of acknowledgments than normal. By calculating the sequence number and payload of the sender's packet, the expected acknowledgment number is obtained. The expected acknowledgment number is compared with the acknowledgment number in the actual receiver's packet. If the actual acknowledgment number is greater than the expected acknowledgment number, the flow is determined to be an optimistic ACK attack flow, and the flow is added to the packet loss list for discarding. ECN abuse of defense process: S4. Select the length of the switch egress queue as a feature in the programmable data plane; A program for collecting traffic feature data is loaded into a programmable switch. The collected features are appended as fields in a custom protocol header to cloned data packets and then sent to a switch that has deployed a detection model. The protocol header fields of these data packets are then parsed to obtain a feature set used to train the ECN abuse detection model. The S5.ECN abuse detection model uses an artificial neural network to classify flows into two categories: normal flows and congested flows. If the detection result is 0, the flow is determined to be a normal flow; if the detection result is 1, the flow is determined to be a congested flow, thereby realizing the detection of ECN abuse. S6. To mitigate ECN abuse, a control state transition method is used to control the switch's behavior. There are two states: secure and congested. When the link is congested and the receiver does not change the ECE flag, the switch takes mitigation measures and transitions from the secure state to the congested state. When the switch is in the secure state, the ECE flag in the receiver's packets is set to 0; when the switch is in the congested state, the ECE flag in the receiver's packets is set to 1. The normalized features in the artificial neural network in steps S2 and S5 are implemented using longest prefix matching flow table entries. Specifically, the table structure in the programmable data plane stores flow rules in the form of tuples <match, action>, and each flow table entry stores a mask corresponding to a prefix. Each prefix used for matching represents the input value of a feature within a range, and the output when the prefix is ​​matched is: Where y is the output when the prefix is ​​matched; , These are the left and right boundary endpoints of the interval, respectively; , These are the true normalized values ​​corresponding to the left and right boundaries, respectively.

2. The defense method according to claim 1, characterized in that, In step S1, the ACK sequence number step size is selected as a feature in the optimistic ACK attack defense. The formula for calculating the ACK sequence number step size is: Where step is the ACK sequence number step size; It is the acknowledgment number in the last message received by the receiver in the detection window; It is the acknowledgment number in the initial message from the receiver in the detection window.

3. The defense method according to claim 1, characterized in that, In step S4, the length of the switch egress queue is selected as a feature in the ECN abuse defense to quantify the degree of network congestion.

Images