Method and system for detecting ipv6 neighbor discovery protocol spoofing threats based on probe validation

Abstract

The present application relates to the technical field of IPv6 network security, and particularly relates to a method and system for detecting IPv6 neighbor discovery protocol spoofing threats based on probe verification, which probes target IPv6 network data packets, acquires node information of living nodes in a local link, and stores the node information in the link by using a data table; the nodes in the link are divided into host nodes and router nodes according to the node information stored in the data table, authenticity verification is performed on each host node and each router node, and nodes with abnormal authenticity verification are marked; detection rules are set based on authenticity verification results, and pre-defined rules are set based on RFC specifications, and the rules are used to detect spoofing threats of the target IPv6 network, so that corresponding response measures are used to block nodes with suspicious spoofing threat activities. The present application has more comprehensive detection, does not need to know in advance which node information is trusted, has lower complexity, does not need to maintain multiple data tables for recording packets and node information, is convenient for deployment and implementation in actual networks, and has a good application prospect in the field of network security protection.

Description

Technical Field

[0001] The present invention relates to the technical field of IPv6 network security, and in particular to a method and system for detecting IPv6 neighbor discovery protocol deception threats based on detection verification. Background Art

[0002] The Neighbor Discovery Protocol (NDP) is a key component of the IPv6 protocol architecture. It describes the basic communication mechanism of IPv6 networks, combining the address resolution and redirection functions of IPv4 with new features such as Neighbor Unreachability Detection (NUD) and Duplicate Address Detection (DAD). These features bring advantages to IPv6 networks, such as more efficient address resolution, neighbor node discovery and management, automatic configuration, more reliable mobility support, and reduced network broadcasts, thereby ensuring the effectiveness and reliability of IPv6 network communications.

[0003] The IPv6 Neighbor Discovery Protocol (NDP) consists of five messages: Router Solicitation (RS), Router Advertisement (RA), Neighbor Solicitation (NS), Neighbor Advertisement (NA), and Redirect (RD). Table 1 shows the information, application scenarios, and functional descriptions of NDP protocol messages.

[0004] Table 1 Neighbor Discovery Protocol message functions and application scenarios

[0005]

[0006] As the number of networks built on the NDP protocol continues to grow, its security and stability are becoming increasingly important. While NDP brings many advantages to IPv6 networks, it also has some security flaws. The NDP protocol lacks a message authentication mechanism, which provides threat actors with opportunities for message forgery and spoofing. Spoofing is one of the two main threats that seriously impact NDP security. Spoofing occurs when an attacker forges identities or manipulates data traffic to mislead network devices, causing them to execute malicious commands or leak sensitive information.

[0007] Research on NDP spoofing threats can be categorized into passive monitoring and active detection. Passive monitoring identifies spoofed packets by monitoring host message information within the link, while active detection primarily sends probe messages to build and maintain information such as the host's IPv6 address, MAC (Media Access Control) address, and the mapping between IPv6 and MAC addresses to identify spoofed packets. However, neither approach effectively addresses the NDP spoofing threat. Summary of the Invention

[0008] To this end, the present invention provides an IPv6 Neighbor Discovery Protocol deception threat detection method and system based on detection verification, which solves the problems of existing IPv6 Neighbor Discovery Protocol deception threat detection technology, such as incomplete detection types, high complexity, and high maintenance cost.

[0009] According to the design scheme provided by the present invention, on the one hand, a method for detecting IPv6 neighbor discovery protocol spoofing threats based on detection verification is provided, comprising:

[0010] Detect the target IPv6 network data packets and obtain the surviving node information in the local link, and use the data table to store the node information in the link;

[0011] Based on the node information stored in the data table, the nodes in the link are divided into host nodes and router nodes. The authenticity of each host node and each router node is verified separately, and the nodes with abnormal authenticity verification are marked;

[0012] Detection rules are set based on the authenticity verification results and predefined rules are set based on RFC specifications. Detection rules and predefined rules are used to detect spoofing threats on the target IPv6 network, so that corresponding response measures can be used to block nodes with suspicious spoofing threat activities.

[0013] As the IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification of the present invention, further, detecting the target IPv6 network data packet and obtaining the surviving node information in the local link includes:

[0014] The detection device is used to detect the local link node information in the target IPv6 network based on the Multicast Listener Discovery Protocol (MLD) scanning technology, and the surviving node information in the local link is obtained based on the response data of each node.

[0015] As the IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification of the present invention, further, based on the Multicast Listener Discovery Protocol MLD scanning technology, local link node information in the target IPv6 network is detected, including:

[0016] The detection device sends an ICMPv6 multicast listener query packet to the link-local scope all-node multicast address in the target IPv6 network and sets the maximum response delay parameter in the query packet;

[0017] Under the maximum response delay parameter condition, the detection device uses the received ICMPv6 multicast listener report packets to obtain the information of surviving nodes in the local link.

[0018] As the IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification of the present invention, further, authenticity verification of the host node is performed, including:

[0019] The detection device sends a first neighbor solicitation message to each host node in the link, where the target address in the first neighbor solicitation message is set to the IPv6 address of the corresponding host node to be authenticated;

[0020] If the neighbor advertisement message that the host node replies to the first neighbor solicitation message duplicates the neighbor advertisement messages that other host nodes reply to or does not reply to the neighbor advertisement message, the detection device sends a second neighbor solicitation message to each node in the link, and the target address in the second neighbor solicitation message is set to a false address;

[0021] If the neighbor advertisement message that the host node replies to the first neighbor solicitation message does not overlap with the neighbor advertisement messages that other host nodes reply to, or if the host node does not reply to the second neighbor solicitation message with a neighbor advertisement message, the host node is determined to be a normal host;

[0022] If the host node replies to the second neighbor solicitation message with a neighbor advertisement message, the host node is determined to be a malicious host.

[0023] As the IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification of the present invention, further, authenticity verification of the router node is performed, including:

[0024] The detection device uses its own link-local address as the source address and actively sends multicast router solicitation messages to the multicast addresses of all routers in the link. It determines whether the local link state parameters of the router advertisement messages replied by each node in the link are the same as those of the detection device. If they are the same, the router node is determined to be a normal router. Otherwise, the router node is determined to be a malicious router.

[0025] As the IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification of the present invention, further, detection rules are set based on the authenticity verification results, and predefined rules are set based on the RFC specifications, including:

[0026] RFC specification rules are set according to the RFC document. Node rules that are detected in the target IPv6 network as alive, pass the authenticity verification, and comply with the RFC specification rules are marked as trusted rules; node rules that are detected as alive but fail the authenticity verification are marked as malicious deception rules; node rules that are detected as alive but the message does not comply with the RFC specification rules are marked as warning rules, and other node rules that are not detected are marked as unknown rules.

[0027] As the IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification of the present invention, further, spoofing threat detection is performed on the target IPv6 network using detection rules and predefined rules, including:

[0028] Set network traffic filtering parameters for intrusion detection tools to deploy detection rules to them.

[0029] Use intrusion detection tools to detect and respond to NDP protocol spoofing threats on the target IPv6 network.

[0030] On the other hand, the present invention also provides an IPv6 neighbor discovery protocol deception threat detection system based on detection and verification, comprising: a node detection module, an information verification module and a detection response module, wherein:

[0031] The node detection module is used to detect the target IPv6 network data packets and obtain the surviving node information in the local link, and store the node information in the link using a data table;

[0032] An information verification module is used to divide the nodes in the link into host nodes and router nodes based on the node information stored in the data table, perform authenticity verification on each host node and each router node respectively, and mark nodes with abnormal authenticity verification;

[0033] The detection and response module is used to set detection rules based on the authenticity verification results and set predefined rules based on the RFC specifications. It uses the detection rules and predefined rules to detect deception threats on the target IPv6 network and use corresponding response measures to block nodes with suspicious deception threat activities.

[0034] Beneficial effects of the present invention:

[0035] This invention uses an active method to detect and verify the network, thereby recording network information and identifying malicious host information within the network. It then constructs threat detection rules using the obtained real and deceptive information, and sets predefined rules based on the message format requirements in RFC. Based on these constructed rules, it detects deceptive threats in the neighbor discovery protocol, improving the comprehensiveness of target network deceptive threat detection. Experimental results further demonstrate that this solution can detect nine types of neighbor discovery protocol deception threats, a more comprehensive approach compared to existing passive monitoring methods such as NDPmon, which can detect five types of deception, and active detection methods such as NS, which can detect three types of deception. Furthermore, compared to passive monitoring methods, it does not require advance knowledge of which node information is trustworthy. Compared to active detection methods, it is less complex and does not require the maintenance of multiple data tables recording message and node information, making it easier to deploy and implement. This approach has promising application prospects in the field of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a schematic diagram of the IPv6 Neighbor Discovery Protocol spoofing threat detection principle based on detection verification in an embodiment;

[0037] Figure 2 This is a schematic diagram of the NDP spoofing threat detection process in the embodiment;

[0038] Figure 3 This is a schematic diagram of the multicast listener message detection principle in the embodiment;

[0039] Figure 4 This is a schematic diagram of the IPv6 node information verification principle in the embodiment;

[0040] Figure 5 This is a schematic diagram of the experimental topology in the detection and verification stage of the embodiment;

[0041] Figure 6 This is a schematic topology diagram of a neighbor discovery protocol deception threat detection experiment in an embodiment;

[0042] Figure 7 This is a topology diagram of a neighbor unreachable detection deception threat detection experiment in an embodiment;

[0043] Figure 8 This is a topology diagram of a duplicate address detection and spoofing threat detection experiment in the embodiment;

[0044] Figure 9 This is a schematic diagram of the topology of the default router replacement deception threat detection experiment in the embodiment;

[0045] Figure 10 The figure shows the topology of the redirection deception threat detection experiment in the embodiment. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.

[0047] The NDP protocol usually runs in the IPv6 local link and involves node devices such as routers and hosts. Depending on the objects involved, IPv6 Neighbor Discovery Protocol spoofing threats can be divided into two categories: non-router / route-related spoofing and router / route-related spoofing. Current research on NDP spoofing threat detection has problems such as insufficient comprehensiveness and high complexity. To this end, an embodiment of the present invention provides an IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification, comprising:

[0048] S101: Detect target IPv6 network data packets and obtain information about surviving nodes in a local link, and store the node information in the link in a data table.

[0049] Specifically, a detection device may be used to detect local link node information in the target IPv6 network based on the Multicast Listener Discovery Protocol (MLD) scanning technology, and information on surviving nodes in the local link may be obtained based on response data from each node.

[0050] The detection device sends ICMPv6 multicast listener query packets to the multicast addresses of all nodes in the local link range of the target IPv6 network, and sets the maximum response delay parameter in the query packet; under the maximum response delay parameter condition, the detection device uses the received ICMPv6 multicast listener report packets to obtain the surviving node information in the local link.

[0051] like Figure 2 The NDP protocol spoofing threat detection principle shown is based on MLD-based IPv6 local link node information detection, followed by host and router information authenticity verification, and then detection rules and predefined rules are set, finally detecting NDP protocol spoofing threats.

[0052] A spoofer often acts as a host, hiding in an IPv6 local link. If IPv6 link node information can be constructed through certain means, it will be of great significance for subsequent spoofing threat detection. Multicast Listener Discovery (MLD) is one of the protocols used for multicast group membership management in IPv6 networks. MLD scanning technology uses the fact that IPv6 live hosts will respond to ICMPv6 multicast listener query packets, such as Figure 3The IPv6 alive host announces the feature of the IPv6 multicast destination address it wants to accept in the IPv6 link after receiving the query data packet; the MLD method actually sends the ICMPv6 multicast listener query data packet to the link local range all node multicast address (ff02::1) and sets the maximum response delay of the query to 1 second to arouse the host to respond immediately, so as not to wait for other responses from its multicast group; further, the ICMPv6 multicast listener report data packet responded by the alive node in the IPv6 link is used to find the alive IPv6 node information in the IPv6 link.

[0053] After the link node information is probed, a data table storing the IPv6-MAC information is obtained. The table records the IPv6 address and MAC address information of the IPv6 nodes (including routers and hosts) in the link.

[0054] S102, according to the node information stored in the data table, the nodes in the link are divided into host nodes and router nodes, and the authenticity of each host node and each router node is verified, and the nodes with abnormal authenticity are marked.

[0055] Through information detection, the information of each node in the target IPv6 local link network is obtained, and then the authenticity of each node information is verified. The authenticity of the host node can be designed to include:

[0056] The detection device sends a first neighbor request message to each host node in the link, and the target address in the first neighbor request message is set as the IPv6 address of the corresponding host node to be verified;

[0057] If the neighbor advertisement message replied by the host node to the first neighbor request message is repeated with the neighbor advertisement message replied by other host nodes or no neighbor advertisement message is replied, the detection device sends a second neighbor request message to each node in the link, and the target address in the second neighbor request message is set as a false address;

[0058] If the neighbor advertisement message replied by the host node to the first neighbor request message is not repeated with the neighbor advertisement message replied by other host nodes or no neighbor advertisement message is replied to the second neighbor request message, the host node is determined to be a normal host;

[0059] If the host node replies a neighbor advertisement message to the second neighbor request message, the host node is determined to be a malicious host.

[0060] As Figure 4As shown in the figure, the detection device, acting as the detection host, first sends an NS message to each node on the link. The destination address of this NS message is set to the IPv6 address of each node to be queried. This message is used to verify the information of each node. All normal hosts on the link will respond to this message with an NA message carrying their own information. Next, the detection host continues to send an NS message to each node on the link. The destination address of this NS message can be set to a false address. Normal hosts on the link will not respond to this message because the NS message is not querying itself.

[0061] Therefore, if a host responds to the first NS message normally and does not repeat other NA messages, it is marked as a normal host. If a host does not respond to the first NS message or the NA message it replies to is repeated, the detection host sends a second NS message for verification. If a host responds to the second NA message, it is marked as a malicious host.

[0062] Authenticity verification of router nodes can be designed to include:

[0063] The detection device uses its own link-local address as the source address and actively sends multicast router solicitation messages to the multicast addresses of all routers in the link. It determines whether the local link state parameters of the router advertisement messages replied by each node in the link are the same as those of the detection device. If they are the same, the router node is determined to be a normal router. Otherwise, the router node is determined to be a malicious router.

[0064] like Figure 4 As shown, the detection device, acting as the detection host, uses its link-local address as the source address and proactively sends an RS message to the link-local all-router multicast address (ff02::2). Normal hosts on the link do not respond to this message; only routers and spoofed hosts within the link will. If the prefix, MTU, and hop limit information in the captured RA reply message differ from those of the hosts within the link, it indicates the presence of an RA spoofing host on the network. If the prefix, MTU, and hop limit information in the captured RA reply message matches those of the hosts within the link, it indicates that there is no RA spoofing on the link.

[0065] The key to detection lies in the selection of information such as prefix, MTU, and hop limit. These network parameters must represent the state of the local link and ensure that the IP address being tested for RA spoofing threats is not used by legitimate hosts on the link. This means that the network parameters and address information of the testing host itself are normal. In short, the principle of RA spoofing detection is to select a monitoring host as "bait" to induce spoofing.

[0066] S103. Set detection rules based on the authenticity verification result, and set predefined rules based on the RFC specification, and use the detection rules and predefined rules to detect deception threats on the target IPv6 network, so as to use corresponding response measures to block nodes with suspicious deception threat activities.

[0067] Specifically, detection rules are set based on the authenticity verification results, and predefined rules are set based on the RFC specification, which can be designed to include:

[0068] RFC specification rules are set according to the RFC document. Node rules that are detected in the target IPv6 network as alive, pass the authenticity verification, and comply with the RFC specification rules are marked as trusted rules; node rules that are detected as alive but fail the authenticity verification are marked as malicious deception rules; node rules that are detected as alive but the message does not comply with the RFC specification rules are marked as warning rules, and other node rules that are not detected are marked as unknown rules.

[0069] During the detection and verification phase, network data packets are collected and analyzed to obtain information about IPv6 local link nodes and verify the authenticity of the node information. This information includes, but is not limited to, the node's IPv6 address, MAC address, link-layer address information, message fields, and flag information. Next, the collected network information and verified spoof information need to be organized to generate detection rules. Node information that has been detected and passed verification can be classified as trusted, while node information that has been detected but not passed verification can be classified as spoofed. Information that has not passed the detection and verification phase can be classified as unknown. Detection rules are key to monitoring and identifying spoofing threats. They indicate when and where anomalies occur, enabling swift countermeasures.

[0070] In addition to setting detection rules, you can also configure predefined rules. These rules are based on the message parameter recommendations in RFC (Request For Comments) documents. For example, the lifetime field of an RA message is typically not 0, and a router will not send an NA message with the R flag set to 0. The combination of detection rules and predefined rules categorizes traffic into four types: trusted, spoofed, warning, and unknown, as shown in Table 2.

[0071] Table 2 Rule setting description

[0072]

[0073] The target IPv6 network is detected for a spoofing threat by using the detection rule and the predefined rule, and the network traffic filtering parameter of the intrusion detection tool can be set to deploy the detection rule to the intrusion detection tool.

[0074] The spoofing threat detection of the NDP protocol is a core stage in the whole process, and is aimed at accurately and efficiently detecting the spoofing threat of the NDP protocol. The detection rule and the predefined rule set in the previous stage are used to deploy the spoofing threat detection rule. Once suspicious activities are detected, the corresponding response measures are triggered immediately to prevent malicious traffic and isolate the affected nodes, so as to protect the normal operation of network resources and services. This stage can be completed by means of the intrusion detection tool Suricata.

[0075] Suricata is a mature, stable and high-performance network threat detection engine with multi-threading, built-in support for IPv6 and the like, and can perform real-time intrusion detection (IDS) and network security monitoring (NSM). It relies on powerful and extensible rules and feature languages to filter network traffic, so it can be easily combined with the previous stage. However, although Suricata itself supports the IPv6 protocol, it does not provide keywords for checking some fields of the ICMPv6 protocol, such as the router lifetime field in the RA message, the R, S and O markers in the NA message, and the like. Therefore, the source code of the Suricata tool can be rewritten and optimized to meet the field settings in the NDP protocol message.

[0076] Further, based on the above method, the embodiment of the present application also provides an IPv6 neighbor discovery protocol spoofing threat detection system based on probe verification, comprising a node probe module, an information verification module and a detection response module, wherein,

[0077] The node probe module is used to probe the target IPv6 network data packet and obtain the node information of the surviving nodes in the local link, and the data table is used to store the node information in the link;

[0078] The information verification module is used to divide the nodes in the link into host nodes and router nodes according to the node information stored in the data table, and to verify the authenticity of each host node and each router node, and to mark the nodes with abnormal authenticity verification;

[0079] The detection response module is used to set the detection rule based on the authenticity verification result, and to set the predefined rule based on the RFC specification, and to detect the spoofing threat of the target IPv6 network by using the detection rule and the predefined rule, so as to block the nodes with suspicious activities of the spoofing threat by using the corresponding response measures.

[0080] To verify the effectiveness of the scheme, the following experimental data are further explained:

[0081] The experiments were conducted on a secure local network to evaluate the functionality and performance of the proposed mechanism. The experimental topology consists of normal hosts, normal routers, spoofing hosts, and detection hosts, forming an IPv6 link. The specific network topology is set according to the different experiments. Among them, the normal hosts and routers in the link can normally reply to the legality of the message, and the host for spoofing threat detection is a normal host in the link. The spoofers perform spoofing threats, which are mainly achieved through tools such as Scapy library, THC-IPv6, and IPv6 Toolkit, and the traffic activity in the network topology is monitored using Wireshark. In the detection and verification stage, Python programming language is used for development. In the detection stage, the intrusion detection tool Suricata6 is used after the source code has been modified and optimized.

[0082] The experimental design and verification part includes three contents, first is the effectiveness verification of the detection and verification mechanism, then respectively carries on the experiment verification to the non-router / router related spoofing threat detection and router / router related spoofing threat detection.

[0083] 1. Analysis of detection and verification stage

[0084] The purpose of the experiment is to verify the effectiveness of the detection and verification stage in the scheme. The detection stage uses MLD messages to detect the node information in the link. The reason for choosing non-NDP protocol messages is to avoid spoofing by malicious hosts in the detection stage. The verification stage uses NS messages and RS messages to verify the authenticity of the node information obtained by detection. The network topology as shown in Figure 5 includes 1 normal router and 3 normal hosts, as well as 1 detection host and 2 spoofing hosts.

[0085] First, the detection host sends a detection message to the link using MLD. The destination address of this message is ff02::1, which is the multicast address of all nodes in the local link. Therefore, all devices in the link will reply to the response message, and the detection host records the obtained response message. Then, the detection host sends double NS messages for host information authenticity verification and multicast RS messages for router authenticity verification, and records the reply response message. Normal hosts and routers reply with normal NA messages and RA messages in the verification stage. Spoofing host 1 replies with a fake RA message, whose prefix and MTU value are different from those of the detection host. Spoofing host 2 replies with an NA message when the detection host sends the second NS message, as shown in Table 3.

[0086] Table 3 Information in the detection and verification stage

[0087]

[0088] It is worth discussing that if the spoofing host does not spoof in the verification phase, but continues to maintain normal packet exchange. In this case, the spoofing host cannot know whether the packet sent by the verification host is normal packet information exchange or a "decoy" behavior. The spoofing host cannot know the purpose of the detection host in advance and selectively initiate spoofing threats. Therefore, it can be considered that the spoofing host listens to the packets in the network that can perform spoofing threats when spoofing, and does not selectively spoof.

[0089] 2. Non-router / routing related spoofing threat detection and verification

[0090] Non-router / routing related spoofing includes neighbor discovery spoofing, neighbor unreachable detection spoofing, and duplicate address detection spoofing. By default, this part of the experiment is completed, and each experiment is independent and does not affect each other.

[0091] (1) Neighbor discovery protocol spoofing threat detection capability verification

[0092] The experimental topology as shown in Figure 6 is constructed. The normal host A wants to communicate with the normal host B, and does not know the link layer address, so it sends an NS packet to request the link layer address of the normal host B.

[0093] The spoofing host listens to the NS packet, and fakes the IPv6 address of the normal host B, and sets the link layer address as its own to reply to the normal host A. The specific packet information is shown in Table 4. The detection host finds that in the NA packet replied by the spoofing host, the source IPv6 address is fe80::3ecc:eeff:fee1:667e of the normal host B, and the source MAC address is not 36:b7:c0:8e:18:72 of the normal host B, the IPv6-MAC information does not match, and the MAC address belongs to the spoofing host. Therefore, according to the detection rule setting, the spoofing threat detection system will record the NA packet and issue a warning.

[0094] Table 4 Neighbor discovery protocol spoofing threat detection experiment packet information

[0095]

[0096]

[0097] (2) Neighbor unreachable detection spoofing threat detection capability verification

[0098] The experimental topology as shown in Figure 7In the experimental topology shown, normal host B has left the network, and normal host A wants to know whether the normal host B it previously connected to is still connected. Therefore, normal host A will perform neighbor unreachability detection and send an NS message to query normal host B.

[0099] After intercepting the NS message, the spoofed host replies with a forged NA message with the source IPv6 address set to fe80::3ecc:eeff:fee1:667e and the source MAC address set to 36:b7:c0:8e:18:72. This tricks legitimate host A into believing legitimate host B exists and sends subsequent messages to 36:b7:c0:8e:18:72. The specific message information is shown in Table 5. The detection host discovers that the source MAC address in the NA message returned by the spoofed host is 36:b7:c0:8e:18:72, the spoofed host's IPv6-MAC information mismatch. Therefore, according to the detection rule settings, the spoofing threat detection system records the NA message and issues a warning.

[0100] Table 5 Neighbor unreachability detection spoofing threat detection experiment message information

[0101]

[0102] 3) Verification of duplicate address detection and spoofing threat detection capabilities

[0103] Build as Figure 8 In the experimental topology shown, healthy host A is a newly added host and immediately performs duplicate address detection. Healthy host A sends an NS message with a destination address of ff02::1, asking whether the IPv6 address fe80::1447:51ff:fe61:de25 is in use.

[0104] After intercepting the NS message, the spoofing host performs duplicate address detection and replies with a forged NA message, deceiving the newly joined host that the IPv6 address it is querying is already in use. The specific message information is shown in Table 6. The detection host discovers that the source MAC address in the NA message returned by the spoofing host is 36:b7:c0:8e:18:72, the spoofing host's IPv6-MAC information mismatch. Therefore, according to the detection rule settings, the spoofing threat detection system records the NA message and issues a warning.

[0105] Table 6 Duplicate address detection spoofing threat detection experiment message information

[0106]

[0107] 3. Router / routing related deception threat detection and verification

[0108] Router / routing-related deceptions include default router replacement, default router deletion, redirect deception, false link prefix, false address prefix, and parameter deception. By default, when conducting this part of the experiment, the detection and verification phase has been completed, and each experiment is independent and does not affect each other.

[0109] (1) Verification of the Default Router Replacement Deception Threat Detection Capability

[0110] Build as Figure 9 In the experimental topology shown, a legitimate host C sends an RS message in an attempt to obtain information about routers within the link. After the spoofed host intercepts the RS message, it replies with an RA message to host C, announcing its own information. Upon receiving the RS message, the legitimate router also replies with an RA message to advertise its information. The spoofed host then, posing as a legitimate router, sends an RA message with a lifetime of 0, thereby killing the legitimate router. The spoofed host then replaces the legitimate router. The specific message information is shown in Table 7.

[0111] Table 7 Default router replacement spoofing threat detection experiment message information

[0112]

[0113] The detection host monitors the first RA message sent back by the spoofed host and finds that both its source IPv6 and source MAC addresses belong to a malicious node. Furthermore, the router lifetime in the second message sent back by the spoofed host is 0. Therefore, according to the detection rules, both spoofed RA messages will be recorded by the spoofing threat detection system and a warning will be issued.

[0114] (2) Verification of the Default Router Deletion Spoofing Threat Detection Capability

[0115] Continue to use Figure 9 In the experimental topology shown, based on the principle of default router removal spoofing, there are four methods to remove the default router. Denial of service (DoS) does not qualify as spoofing, and its detection will be explored in the next chapter. The fake router lifetime method was also described in the previous experiment. Therefore, this experiment will use the remaining two methods: NA packets with the R flag set to 0 and higher priority.

[0116] Table 8 Default router deletion spoofing threat detection experiment message information

[0117]

[0118] In the former case, the spoofing host will send a fake NA message posing as the default router, with the R flag set to 0. The detection host will intercept the NA message from the "router" and find that its R flag is set to 0, which is not normal. Based on the detection rules and predefined policies, the spoofing threat detection system will record and issue an alert.

[0119] In the latter case, the spoofed host sends an RA message with a higher priority (01), replacing the default router. The spoofed host, now the default router, then sends a fake RA message with a router lifetime of 0, deleting itself. After the detection host monitors these two RA messages, it discovers that their source IPv6 and source MAC addresses both belong to malicious nodes, and that the router lifetime in the second RA message sent by the spoofed host is 0. Based on the detection rules and predefined rules, both spoofed RA messages will be recorded by the spoofing threat detection system and a warning will be issued. The specific message information is shown in Table 8.

[0120] (3) Verification of redirection deception threat detection capabilities

[0121] Build as Figure 10 In the experimental topology shown, all communications between legitimate host C and the remote host must be forwarded through a legitimate router. The spoofed host initiates a redirect spoof, impersonating a legitimate router and sending a redirect message to legitimate host C. The redirect message's link layer address field indicates a better next hop address to the destination address, which the spoofed host sets to its own MAC address, 34:50:c3:09:71:99. Upon receiving the redirect message, the legitimate host confirms that the source address is from a legitimate router and updates its routing table based on the redirect message, handing off subsequent packets to the spoofed node for forwarding. Upon detecting the redirect message, the detection host discovers that its link layer address belongs to a malicious node. Therefore, the redirect message is recorded by the spoofing threat detection system, which issues a warning.

[0122] (4) Verification of the ability to detect false link prefixes, false address prefixes, and parameter spoofing threats

[0123] Spoofing often works in conjunction with fake link prefixes and address prefixes. A spoofing host sends a forged RA message containing a fake address prefix and a link prefix field set to 1. Upon intercepting this RA message, the detection host discovers that the address prefix carried in the message differs from the RA message prefix sent by a legitimate router during the detection and verification phase. Therefore, the spoofing threat detection system records the message and issues a warning.

[0124] For parameter spoofing in RA packet, including MTU spoofing, hop limit spoofing, etc. The host sends a false RA packet with MTU value less than the actual value of link MTU, such as MTU value of 1; sends a hop limit packet with a very small value, such as setting the hop limit value in RA to 1. These parameter values are generally considered unreasonable in the official RFC document. The pre-defined rule sets a fixed value according to the suggestion of the parameter value in the packet in the RFC document, such as MTU of 1500, hop limit value of 255. Therefore, the parameter value in the packet that does not meet the pre-defined rule setting will be recorded and a warning will be issued.

[0125] Table 9 Comparison of NDP spoofing threat detection capabilities

[0126]

[0127]

[0128] As shown in Table 9, compared with the existing detection method, the scheme of the present case can effectively detect the spoofing threats in the NDP protocol, and the detected types are more comprehensive, the maintenance cost is lower, and the complexity is lower.

[0129] (1) More comprehensive spoofing threat detection

[0130] The spoofing threat detection technology proposed in the present case can detect more types of spoofing threats, including non-router / router related spoofing and router / router related spoofing, etc. a total of 9 types, as shown in Table 9. Snort, Suricata, etc. in passive monitoring method can detect 5 types, and active detection method can only detect 3 types of non-router / router related spoofing. In addition to setting detection rules, pre-defined rules that follow RFC specifications are also set, and many spoofing threats are generated because the packet field does not follow the RFC specification.

[0131] (2) Lower maintenance cost

[0132] The spoofing threat detection technology proposed in the present case has lower maintenance cost. Generally, the existing passive monitoring method requires the network administrator to know in advance which devices in the network are trusted and which devices are abnormal, and to configure the spoofing threat detection information according to the known information. This requires high manual maintenance cost in real situation, and is prone to errors. Especially when the network sends dynamic changes, the entire detection rule may need to be reconfigured. The present case can automatically detect and verify node information, and generate detection rules according to the information. In addition, whenever a new node joins, only the new node needs to be verified, and then the detection rule needs to be updated.

[0133] (3) Lower complexity

[0134] The proposed spoofing threat detection technology is less complex. Compared to existing detection methods, which typically require maintaining multiple data tables recording message and node information, such as first recording network node information and then collecting and analyzing every NS or NA message sent on the network to identify spoofing messages, the proposed technology only requires recording two data tables for the detection and verification phases and then forming detection rules. This eliminates the need to record every message in the network, resulting in lower complexity.

[0135] The above experimental results show that this solution can identify malicious host information in the network and detect deception threats in the neighbor discovery protocol through detection rules. It does not require advance knowledge of which node information is trustworthy, and does not require maintenance of multiple data tables recording messages and node information. It has low complexity and low maintenance cost, is easy to deploy and implement in actual networks, and has good application prospects.

[0136] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0137] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0138] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0139] Those skilled in the art will appreciate that all or part of the steps in the above method can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiment can be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.

[0140] Finally, it should be noted that the above-described embodiments are merely specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, but not to limit the same. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that any person skilled in the art can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features, within the technical scope disclosed by the present application. The modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for detecting IPv6 neighbor discovery protocol spoofing threats based on detection verification, characterized in that: Include: Detect the target IPv6 network data packets and obtain the surviving node information in the local link, and use the data table to store the node information in the link; Based on the node information stored in the data table, the nodes in the link are divided into host nodes and router nodes. The authenticity of each host node and each router node is verified separately, and the nodes with abnormal authenticity verification are marked; Setting detection rules based on the authenticity verification results and setting predefined rules based on RFC specifications, specifically including: setting RFC specification rules according to RFC documents, marking node rules that are detected to be alive in the target IPv6 network and have passed the authenticity verification and comply with RFC specification rules as trusted rules; marking node rules that are detected to be alive but have failed the authenticity verification as malicious deception rules; marking node rules that are detected to be alive but whose messages do not comply with RFC specification rules as warning rules, and marking other node rules that have not been detected as unknown rules; Detect spoofing threats on target IPv6 networks using detection rules and predefined rules, and take appropriate response measures to block nodes with suspicious spoofing threat activities.

2. The IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification according to claim 1, characterized in that: Detect target IPv6 network packets and obtain information about surviving nodes on the local link, including: The detection device is used to detect the local link node information in the target IPv6 network based on the Multicast Listener Discovery Protocol (MLD) scanning technology, and the surviving node information in the local link is obtained based on the response data of each node.

3. The IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification according to claim 2, characterized in that: Detects local link node information in the target IPv6 network based on the Multicast Listener Discovery (MLD) scanning technology, including: The detection device sends an ICMPv6 multicast listener query packet to the link-local scope all-node multicast address in the target IPv6 network and sets the maximum response delay parameter in the query packet; Under the maximum response delay parameter condition, the detection device uses the received ICMPv6 multicast listener report packets to obtain the information of surviving nodes in the local link.

4. The IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification according to claim 1, characterized in that: Verify the authenticity of the host node, including: The detection device sends a first neighbor solicitation message to each host node in the link, where the target address in the first neighbor solicitation message is set to the IPv6 address of the corresponding host node to be authenticated; If the neighbor advertisement message that the host node replies to the first neighbor solicitation message duplicates the neighbor advertisement messages that other host nodes reply to or does not reply to the neighbor advertisement message, the detection device sends a second neighbor solicitation message to each node in the link, and the target address in the second neighbor solicitation message is set to a false address; If the neighbor advertisement message that the host node replies to the first neighbor solicitation message does not overlap with the neighbor advertisement messages that other host nodes reply to, or if the host node does not reply to the second neighbor solicitation message with a neighbor advertisement message, the host node is determined to be a normal host; If the host node replies to the second neighbor solicitation message with a neighbor advertisement message, the host node is determined to be a malicious host.

5. The IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification according to claim 1, characterized in that: Verify the authenticity of the router node, including: The detection device uses its own link-local address as the source address and actively sends multicast router solicitation messages to the multicast addresses of all routers in the link. It determines whether the local link state parameters of the router advertisement messages replied by each node in the link are the same as those of the detection device. If they are the same, the router node is determined to be a normal router. Otherwise, the router node is determined to be a malicious router.

6. The IPv6 Neighbor Discovery Protocol spoofing threat detection method based on detection verification according to claim 1, characterized in that: Detect spoofing threats on target IPv6 networks using detection rules and predefined rules, including: Set network traffic filtering parameters for intrusion detection tools to deploy detection rules to them. Use intrusion detection tools to detect and respond to NDP protocol spoofing threats on the target IPv6 network.

7. An IPv6 Neighbor Discovery Protocol spoofing threat detection system based on detection verification, characterized in that: It includes: node detection module, information verification module and detection response module, among which, The node detection module is used to detect the target IPv6 network data packets and obtain the surviving node information in the local link, and store the node information in the link using a data table; An information verification module is used to divide the nodes in the link into host nodes and router nodes based on the node information stored in the data table, perform authenticity verification on each host node and each router node respectively, and mark nodes with abnormal authenticity verification; A detection response module is used to set detection rules based on the authenticity verification results and set predefined rules based on the RFC specifications, and use the detection rules and predefined rules to detect deception threats on the target IPv6 network, so as to use corresponding response measures to block nodes with suspicious deception threat activities. Among them, setting detection rules based on the authenticity verification results and setting predefined rules based on the RFC specifications specifically includes: setting RFC specification rules according to RFC documents, marking node rules that are detected to be alive in the target IPv6 network and have passed the authenticity verification and comply with the RFC specification rules as trusted rules; marking node rules that are detected to be alive but have not passed the authenticity verification as malicious deception rules; marking node rules that are detected to be alive but the message does not comply with the RFC specification rules as warning rules, and marking other node rules that have not been detected as unknown rules.

8. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 6 can be implemented.

Images