Anti-Traceroute network topology confusion system based on P4

Abstract

The invention relates to an anti-Traceroute network topology confusion system based on a P4 (Point 4). The system comprises a node selector, a topology forgger, a configuration generator and confusion nodes, the node selector is used for identifying key nodes in a target network by utilizing a plurality of evaluation indexes and calculating a node upgrading strategy of confusion nodes under the condition of meeting cost constraints; the topology forgger is used for constructing a false topology according to the target network topology and the node upgrading strategy of the confusion node; the configuration generator is used for converting the false topology into configuration information of data packet processing logic of the confusion node by using a P4 program and issuing the configuration information to the confusion node so as to deploy the false topology on a data plane; and the confusion node is used for executing customized topology confusion data packet processing logic on the data plane to present false topology information for malicious detection data packets and respond to normal detection data packets with real topology information. By adopting the system, the network security can be improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a P4-based anti-Traceroute network topology obfuscation system. Background Art

[0002] Traceroute is a standard path tracing tool, which is mainly used to display the hop-by-hop information of the path between packets and hosts in detail (such as the IP address of the intermediate router). It detects the routing path by sending a series of probe packets with increasing TTL values ​​from the source to the destination. When a packet arrives at a router, the router first checks whether the TTL value of the packet is equal to 1. If it is, it will discard the packet and send an ICMP timeout message containing the IP address of the router's inbound interface to prevent the packet from looping infinitely in the network; if not, the router will reduce the TTL value of the packet by 1 and forward it to the next hop router. Therefore, based on the above forwarding rules, starting from TTL=1, the source sends a probe packet with a TTL value increased by 1 each time, and then receives the ICMP timeout message sent by the internal device until the probe packet can reach the destination. In addition, Traceroute can also use the time difference between sending a packet and receiving the corresponding ICMP timeout message to measure the round-trip time (RTT) of the path. Since the attacker needs to receive the response messages sent by the internal forwarding device of the target network to infer the network topology, the system based on Traceroute is also called internal collaborative topology inference or explicit topology inference. By integrating the detection paths between multiple source and destination ends, the attacker can obtain a complete topology structure, in which each node represents an IP address. This topology is called interface-level topology or IP-level topology. However, a router usually has many interfaces, each with a separate IP address. Therefore, the interface-level topology cannot reflect the underlying physical topology. To do this, the attacker needs to merge different interfaces belonging to the same router into a router node, an operation called alias resolution.

[0003] Existing alias resolution technologies can be divided into two categories based on whether additional probe packets need to be sent: 1) Packet-based alias resolution technologies require sending additional probe packets to check whether two IP addresses belong to the same router. This type of alias resolution technology analyzes the specific content contained in the response message of the additional probe packet, such as the source IP address and IP header options in the ICMP message. 2) Graph-based alias resolution technologies analyze path information without sending additional probe packets. For example, different IP addresses that can reach the same IP address are aliases of each other, while IP addresses in the same probe path are not aliases of each other. After the alias resolution is completed, each node in the probe topology represents an independent network device, which is called a router-level topology and can be used to infer key node and link information of the target network. An attacker can build an interface-level topology by merging the same node and link information in the collected path information. In order to obtain the underlying physical network structure, the attacker can use alias resolution technology to convert the interface-level topology into a router-level topology. Router-level topology can help attackers locate key nodes and links in the target network, thereby building a cost-effective attack strategy. After finding some key nodes and links, attackers can flood a small number of key links to cut off network communications within a certain range of the victim.

[0004] Currently, link flooding attacks have caused serious damage to the global Internet. To solve this problem, programmable routers can try to hide and obfuscate certain specific links by modifying ICMP messages to prevent attackers from finding valid targets. However, systems that only obfuscate IP addresses and create simple virtual paths cannot achieve the effect of obfuscating the importance of links. Even if the link name and code are changed, attackers can still identify the location of the link in the topology, evaluate the importance of the link, and successfully launch attacks, threatening network availability. Summary of the invention

[0005] Based on this, it is necessary to provide a P4-based anti-Traceroute network topology obfuscation system that can improve network security in response to the above technical problems.

[0006] A P4-based network topology obfuscation system that resists traceroute, the system comprising a node selector, a topology forger, a configuration generator, and an obfuscation node;

[0007] The node selector is used to identify key nodes in the target network using multiple pre-set evaluation indicators and calculate the node upgrade strategy of the obfuscated nodes while satisfying the cost constraint;

[0008] The topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated nodes;

[0009] The configuration generator is used to convert the false topology into the configuration information of the data packet processing logic of the obfuscated node by using the P4 program and send it to the obfuscated node to realize the deployment of the false topology on the data plane;

[0010] The obfuscation node is used to perform customized topology obfuscation packet processing logic on the data plane to present false topology information to malicious probe packets and respond to normal probe packets with real topology information.

[0011] The above-mentioned P4-based anti-Traceroute network topology obfuscation system, the present application first uses a plurality of pre-set evaluation indicators to identify the key nodes in the target network and calculates the node upgrade strategy of the obfuscated nodes while satisfying the cost constraint, and preferentially upgrades the nodes with high criticality in the target network to nodes with obfuscation capability, i.e., obfuscated nodes, and then constructs a false topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated nodes, and fabricates a more secure false topology for the attacker, so that the criticality of the nodes in the false topology is more evenly distributed to hide the real key nodes in the network. The false topology is converted into the configuration information of the packet processing logic of the obfuscated node by using the P4 program and sent to the obfuscated node to realize the deployment of the false topology on the data plane, and a new detection packet processing logic is designed for the obfuscated node, which modifies the passed detection packet and feeds back a false ICMP timeout message for the expired detection packet, so as to present a false topology hiding the key nodes to the attacker, thereby greatly improving the network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A schematic diagram of a flow chart of a P4-based anti-Traceroute network topology obfuscation system in an embodiment;

[0013] Figure 2 A schematic diagram of a node splitting process in one embodiment;

[0014] Figure 3 A flowchart of a customized data packet processing logic in an obfuscation node in one embodiment;

[0015] Figure 4 Schematic diagram of the TTL dynamic camouflage strategy in another embodiment; wherein (a) is a detection data packet route map when node E is not upgraded to a confusion node, (b) is a detection data packet route map when node E is not upgraded to a confusion node, and (c) is a detection data packet route map when node E is upgraded to a confusion node and TTL dynamic camouflage is deployed;

[0016] Figure 5A flowchart of an embodiment in which a configuration generator automatically generates and sends configurations for obfuscated nodes based on a real physical network and a false topology. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0018] In one embodiment, a P4-based traceroute-resistant network topology obfuscation system is provided, including a node selector, a topology forger, a configuration generator, and an obfuscation node;

[0019] The node selector is used to identify key nodes in the target network using multiple pre-set evaluation indicators and calculate the node upgrade strategy of the obfuscated nodes while satisfying the cost constraint;

[0020] The topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated nodes;

[0021] The configuration generator is used to convert the false topology into the configuration information of the data packet processing logic of the obfuscated node by using the P4 program and send it to the obfuscated node to realize the deployment of the false topology on the data plane;

[0022] The obfuscation node is used to perform customized topology obfuscation packet processing logic on the data plane to present false topology information to malicious probe packets and respond to normal probe packets with real topology information.

[0023] In the above P4-based anti-Traceroute network topology obfuscation system, Figure 1As shown in the figure, it is mainly composed of four modules: node selector, topology forger, obfuscated node, and configuration generator. It aims to prioritize the deployment of defense mechanisms for nodes with high critical coefficients through a comprehensive evaluation index system, and use the customized data plane processing logic based on the P4 program to fabricate erroneous ICMP timeout messages for attackers to interfere with the attacker's Traceroute-based topology inference. Among them, the node selector is responsible for identifying the key nodes in the network and giving node upgrade strategies while meeting the cost constraint. This module comprehensively uses multiple evaluation indicators to measure the criticality of the nodes to maximize the protection effect while meeting the cost constraint. The topology forger is responsible for building a fake topology with balanced criticality distribution according to the target network topology and the obfuscated node deployment plan to hide the key nodes in the network. This module splits each obfuscated node in the real network into multiple virtual nodes in the fake topology through the node splitting method to disperse the criticality of the obfuscated node to each virtual node. The configuration generator is responsible for issuing corresponding configuration information to the packet processing logic of the obfuscated node according to the false topology and the real network information to realize the deployment of the false topology on the data plane. According to the topology and forwarding behavior of the target network, this module converts the false topology into specific configuration information and sends it to each obfuscation node to guide the obfuscation node to identify and operate potential malicious packets. The obfuscation node is responsible for hiding the obfuscation node from attackers on the data plane and retaining the availability of Traceroute for itself. The obfuscation node converts the false topology generated by the topology forger into customized packet processing logic on the data plane. When a packet arrives, the obfuscation node first distinguishes between normal detection packets and potential malicious packets by retrieving the whitelist, responding to the correct ICMP timeout message for the normal detection packet and fabricating and sending the wrong ICMP timeout message for the potential malicious packet. In addition, the obfuscation node also adopts the TTL dynamic camouflage strategy to prevent attackers from discovering the defense behavior of the target network due to the TTL discontinuity of the received ICMP timeout message.

[0024] In one embodiment, the target network includes a set of nodes and a set of links; the evaluation indicators include degree centrality, flow-based betweenness centrality, and closeness centrality; degree centrality is used to describe the connection probability of a node with other nodes in the network, and is defined as where degree(v) represents the degree of node v; flow-based betweenness centrality is an important indicator for identifying potential key nodes and is defined as Where F represents the set of detection traffic, tvs(f,x) is a binary variable. If it is equal to 1, it means that the routing path of the detection flow f passes through the node v. When identifying key nodes, all possible end-to-end paths with ingress / egress routers as source addresses and destination addresses are considered as potential detection paths for attackers, that is, |F| = ne (n e -1), where n e is the number of ingress / egress routers in the target network; the closeness centrality is where d v,u Represents the distance between nodes v and u.

[0025] In a specific embodiment, the node selector is responsible for accurately identifying potential key nodes in the target network and upgrading the nodes with high criticality to obfuscated nodes preferentially under the condition of meeting the cost constraint. For a given target network G = (V, E), where V represents the set of nodes in the network and E represents the set of links in the network, the following evaluation indicators are used to measure the criticality of the nodes:

[0026] The degree of a node is an important indicator for identifying key nodes. It measures the number of neighboring nodes of a node. The larger the degree of a node, the more edges and nodes are associated with it. Therefore, once a node with a higher degree in the network fails, the failure will affect the forwarding function of multiple nodes around it, resulting in a decrease in network performance. Degree Centrality (DC) is used to describe the probability of a node being connected to other nodes in the network and is defined as Where degree(v) represents the degree of node v.

[0027] Since many networks calculate end-to-end routing paths based on the shortest path, the failure of a node traversed by multiple shortest paths may cause multiple routing paths to fail. Betweenness Centrality (BC) is used to measure the number of shortest paths passing through the same node. Although an attacker may be able to discover all forwarding devices in the target network, the attacker cannot discover all possible routing paths because he cannot hack into every device in the target network. The attacker can only obtain limited routing information by probing the information contained in the path. Inspired by flow density, this application proposes flow-based betweenness centrality (FBC) as an important indicator for identifying potential key nodes, and defines it as Where F represents the set of probe traffic, tvs(f,x) is a binary variable, if it is equal to 1, it means that the routing path of the probe flow f passes through the node v. However, before the attacker starts probing, it is difficult for the target network to predict the location of the attacker's probing host and the probing traffic they send. To this end, when identifying key nodes, we consider all possible end-to-end paths with ingress / egress routers as source and destination addresses as potential probing paths for the attacker, that is, |F| = n e (n e -1), where n eis the number of ingress / egress routers in the target network.

[0028] Network bottlenecks usually occur at the center of the network, so nodes located in the center are more likely to be potential key nodes. That is, the smaller the average distance from a node to other nodes, the higher its criticality. In addition, in a network, the distance can be calculated as the minimum number of hops required between two nodes. Therefore, this application defines Closeness Centrality (CC) as where d v,u Represents the distance (number of hops) between nodes v and u.

[0029] In one embodiment, since upgrading all devices in the network will result in high deployment and management costs, network managers often do not upgrade devices in the network on a large scale, but only prioritize upgrading nodes with high criticality within the cost budget. Therefore, considering the cost constraint, the present application models the node upgrade problem as an integer linear programming problem.

[0030] Calculate the node upgrade strategy of the obfuscated node while satisfying the cost constraint, including:

[0031] Use G = (V, E) to represent the target network topology, where V is the set of nodes in the target network, E is the set of links in the target network, B is the update budget of the network manager, and c is the update budget of the network manager. i Indicates that the node v i ∈V is the upgrade cost required to upgrade to a confusing node, represented by a binary variable x i Represents node v i ∈V is selected to be upgraded to a confusion node if x i =1 means node v i Selected to upgrade to obfuscation node:

[0032] ∑x i c i ≤B

[0033] For each node v i ∈V, using multiple evaluation indicators to comprehensively evaluate the critical score CS(v i )for

[0034]

[0035] Among them, α, β, and γ are weight coefficients that can be adjusted by the network administrator, and α+β+γ=1;

[0036] The optimization objective is to maximize the sum of the criticality scores of the obfuscated nodes, and the node upgrade problem is modeled as an integer linear programming model:

[0037]

[0038] The greedy node selection algorithm is used to solve the integer linear programming model and calculate each node v i ∈V value density τ i Afterwards, each node is traversed in descending order of value density, and the node is upgraded to a confused node within the upgrade cost constraint.

[0039] In a specific embodiment, the node upgrade problem can be considered as a variant of the 0-1 knapsack problem, where the criticality score is set to the value of the item and the update budget is considered to be the weight of the item. Therefore, the node upgrade problem is an NP-hard problem, and a heuristic algorithm needs to be designed to handle large-scale problems. To this end, the present application designs a greedy node selection algorithm to solve this problem. The pseudo code is shown in Table 1 below:

[0040] Table 1

[0041]

[0042] The core of this algorithm is to upgrade nodes with higher value density to obfuscated nodes first. Value density is the ratio of criticality score to upgrade cost. Therefore, the algorithm first calculates the value of each node v i ∈V value density τ i After that, each node is traversed in descending order of value density, and the node is upgraded to a confused node within the scope of the upgrade cost constraint.

[0043] In one embodiment, the topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated node, including:

[0044] Each obfuscated node in the target network is split into multiple interconnected virtual nodes through the node splitting method, and the criticality of the obfuscated node is evenly distributed to each virtual node.

[0045] In a specific embodiment, the topology forger is responsible for generating a fake topology with balanced node criticality based on the real network topology to confuse the attacker's topology inference. To this end, P4Obfu splits the obfuscated nodes in the real network into multiple interconnected virtual nodes in the fake topology. This application refers to this process as node splitting. The insight behind node splitting is to use multiple virtual nodes to share the criticality of the obfuscated nodes, and then hide the obfuscated nodes in the fake topology. For each obfuscated node, the virtual nodes generated by the node splitting are connected by virtual links, and the number of virtual nodes depends on the degree of the obfuscated node in the real network. Assume that there is a obfuscated node v in the target network. i, its degree is n, and its neighbor node is Then, in the fake topology, the obfuscated node will be split into n virtual nodes Each virtual node is connected to one of its neighbor nodes, namely virtual node vn i With neighbor node nn i In addition, virtual nodes are connected to each other, that is, for any virtual node vn i , which is connected to the rest of the virtual nodes There is a virtual link between them. Each virtual node in the fake topology will be presented to the attacker by responding to the attacker's probe packet with an erroneous ICMP timeout message. Figure 2 As shown in Figure 1, there is a confusing node E with a degree of 4 in the network, and its neighbors are A, B, C, and D. In order to hide the confusing node E, the topology forger splits E into 4 interconnected virtual nodes E in the fake topology. 1 , E 2 , E 3 , E 4 , the dotted lines between virtual nodes represent virtual links. In addition, each virtual node is connected to one of the neighboring nodes of the obfuscated node, such as virtual node E 1 Connected to neighbor node A.

[0046] The reason why the topology forger uses node splitting to design a fake topology is due to the following two considerations: 1) Considering the deployment cost, it is difficult for network managers to deploy a topology obfuscation mechanism for all forwarding devices in the network. Therefore, when only a small number of devices in the network have obfuscation capabilities, the obfuscation operation can only be performed after the detection data packet passes through the obfuscation node. In addition, since the detection path is bidirectional, that is, the attacker can control any detection node at both ends of the path to send a detection data packet to another detection node, which makes the non-obfuscation nodes on both sides of the obfuscation node in the detection path be discovered by the attacker. Therefore, only the obfuscation node itself can be hidden instead of the entire detection path. To this end, the topology forger splits a obfuscation node into multiple virtual nodes to share the criticality of the obfuscation node in order to achieve the purpose of hiding the critical node. In addition, the topology forger connects the virtual nodes belonging to the same obfuscation node to each other, so that each detection record can pass through at most two virtual nodes, thereby evenly distributing the detection flow to each virtual node. 2) Unlike NetHide, P4Obfu does not change the routing path of potential malicious data packets when designing a fake topology, but only hides the obfuscation node by node splitting. This is because the rerouting of malicious packets will conflict with the existing load balancing mechanism in the network. In contrast, the virtual nodes and virtual links generated by the topology forger do not actually exist in the network, but by confusing the nodes with malicious packets from the attacker and responding to incorrect ICMP timeout messages, the attacker mistakenly believes that the false topology is the real physical structure of the target network, which makes the false topology generated by node splitting not need to make a trade-off between security and load balancing.

[0047] In one embodiment, converting the false topology into configuration information of the data packet processing logic of the obfuscation node and sending it to the obfuscation node to deploy the false topology before the data plane also includes:

[0048] The obfuscation node will save the detection node whitelist, which contains the information of the measurement nodes controlled by the network administrator. The detection node whitelist will match the source IP address field in the data packet header as a keyword. If the data packet is sent by a node in the detection node whitelist, it will be identified as a normal detection data packet and forwarded according to the normal data packet processing logic; otherwise, all data packets that are not matched by the detection node whitelist will be considered as potential malicious detection data packets and the TTL dynamic camouflage strategy or ICMP error response will be executed according to the TTL value.

[0049] In one of the embodiments, the ICMP error response indicates discarding the data packet that triggers the obfuscation node to execute the ICMP error response and sending an ICMP timeout message containing the IP address of the virtual node and a false TTL value to the source of the malicious detection data packet.

[0050] In a specific embodiment, the obfuscation node is responsible for executing customized topology obfuscation packet processing logic on the data plane to present false topology information to malicious packets and respond to normal detection packets with real topology information. Figure 3 An illustration of the customized packet processing logic in the obfuscation node is given. When the packet arrives at the obfuscation node, normal detection packets and potential malicious packets are distinguished through whitelist matching. Normal packet processing logic is executed for normal detection packets, such as TTL reduction by 1 and forwarding to the next node. Error ICMP timeout messages are responded to or TTL dynamic camouflage is performed for potential malicious detection packets with different TTL values.

[0051] First, in order to distinguish normal detection traffic from malicious detection traffic, the obfuscation node will save a detection node whitelist, which contains the information of the measurement nodes controlled by the network administrator. The whitelist uses the source IP address field in the packet header as a keyword for matching. If the packet is sent by a node in the whitelist, it will be identified as a normal detection packet and forwarded according to the normal packet processing logic; otherwise, all packets not matched by the whitelist will be considered as potential malicious detection packets (including non-detection packets that are not expired on the internal devices of the target network but whose source IP addresses are not in the whitelist), and TTL dynamic camouflage or ICMP error response will be performed according to the TTL value.

[0052] The present application found that in addition to sending detection traffic between the attacker's detection nodes, there will also be normal business traffic to exchange information or cover the sending of detection traffic. Because the false topology generated by the topology forger is different from the real physical network, especially the end-to-end path length. Therefore, if the obfuscation operation is not performed on such non-detection data packets and only the malicious detection data packets are obfuscated, the network topology information implicit in the normal business traffic will be inconsistent with the network topology information collected by the detection traffic. For example, the difference in TTL from when the data packet is sent from the source to when it is received by the destination is inconsistent with the detection path length reflected by the detection data packet, which will undoubtedly make the attacker doubt the authenticity and accuracy of the detection information. Therefore, P4Obfu also regards non-detection data packets whose source IP addresses are not in the whitelist as potential detection data packets and takes obfuscation measures to prevent attackers from noticing the defensive behavior of the target network.

[0053] The topology inference based on Traceroute uses the characteristics of the ICMP protocol to make the detection data packet expire at each intermediate node of the detection path and trigger it to return an ICMP timeout message. The attacker builds the detection topology by collecting the IP address information contained in the ICMP timeout message. Therefore, the control plane will first assign a false IP address to each virtual network interface of the virtual node split from the obfuscated node, so that when the malicious data packet expires at the virtual node and triggers the ICMP timeout message, the assigned false IP address is filled into the ICMP timeout message and sent to the attacker. To this end, the obfuscated node will further determine whether the potential malicious detection data packet will expire at the virtual node split from the obfuscated node. If so, the obfuscated node is responsible for filling the virtual node information into the header of the ICMP timeout message and returning it to the attacker. In addition, since the virtual node does not actually exist in the underlying physical network, both the Traceroute detection data packet and the ICMP timeout message are forwarded according to the real network topology. The false topology is exposed to the attacker through the forged IP address contained in the ICMP timeout message, and does not really change the physical structure and routing path in the real network.

[0054] Due to node splitting, every time a malicious packet passes through a confusion node, the length of its detection path increases by 1. Figure 2 For example, suppose the attacker connects two detection nodes H1 and H2 to nodes A and C respectively, and controls H1 to send Traceroute detection packets to H2. Without deploying any defense strategy, the attacker will obtain a detection path of length 5 (H1-AEC-H2), and after upgrading node E to a confusion node, the attacker will obtain a detection path of length 6 (H1-AE 1 -E 3 -C-H2). Therefore, the obfuscation node will use TTL≤2 to determine whether the malicious data packet will expire on the virtual node split from the obfuscation node, rather than TTL≤1. When a malicious detection data packet arrives at the obfuscation node and TTL≤2, the data packet will trigger the obfuscation node to perform an ICMP error response, that is, discard the data packet and send an ICMP timeout message containing the IP address of the virtual node and a false TTL value to the source of the malicious detection data packet.

[0055] In one embodiment, the configuration generator is used to convert the false topology into the configuration information of the data packet processing logic of the obfuscated node by using the P4 program and send it to the obfuscated node to deploy the false topology on the data plane, including:

[0056] The data plane packet processing logic is developed using the P4 program, and the detection node whitelist and ICMP error response are encoded into two "match-action" tables. Each "match-action" table consists of "key" and "actions", where "key" reveals which fields in the data packet are matched, and "actions" represents a set of actions. The entries in the "match-action" table indicate how to process the data packet, that is, when the "key" field in the header of the data packet hits a table entry, the data packet is processed according to the action corresponding to the table entry; otherwise, the data packet is processed according to the default action, and the false topology is converted into a specific "match-action" table entry and sent to the corresponding obfuscation node to implement the deployment of the false topology.

[0057] In a specific embodiment, the configuration generator is responsible for converting the false topology generated by the topology forger into the configuration information of the packet processing logic of the obfuscated node and sending it to the obfuscated node. In the present application, the P4 program is used to develop the packet processing logic of the data plane, and the node whitelist and ICMP error response mentioned above are encoded into two "match-action" tables. Each "match-action" table consists of "key" and "actions", where "key" reveals which fields in the data packet are matched, and "actions" represents a set of actions. The entries in the "match-action" table reveal how to process the data packet, that is, when the "key" field in the header of the data packet hits a table entry, the data packet is processed according to the action corresponding to the table entry; otherwise, the data packet is processed according to the default action. Therefore, if Figure 5 As shown in Figure 1, the configuration generator converts the false topology into entries in the specific "match-action" table and sends it to the corresponding obfuscation node to implement the deployment of the false topology. The P4 program deployed on the obfuscation node contains many tables to support the normal operation of the network. This section will only introduce the tables related to network topology obfuscation.

[0058] The node whitelist uses the source IP address of the data packet as the keyword to match the data packet, which is used to classify the data packet into normal probe packets and potential malicious packets. The node whitelist contains two actions "normal_packet" and "probe_packet", where "normal_packet" means marking the data packet as a normal probe packet, and "probe_packet" means marking the data packet as a potential malicious packet. The configuration generator uses the IP address of the network interface of the legitimate probe node as the keyword of the table entry, and sets the action of the corresponding entry to "normal_packet". In addition, the default action is set to "probe_packet" to treat all traffic sent by illegal probe nodes as potential malicious packets. Figure 5As shown in the figure, D1 is the measurement node of the network manager. Therefore, the controller sends the IP address of D1's interface eth0 as a whitelist entry to the obfuscation node E. Whenever the source IP address of an arriving data packet hits this entry, the data packet is identified as a normal detection data packet; otherwise, the default action is executed to mark all missed data packets as potential detection data packets.

[0059] The ICMP error response table uses the packet's inbound interface, destination IP address, and TTL as keywords to match packets. It is used to construct an error ICMP timeout message for packets with TTL ≤ 2 and marked as "probe_packet", and returns it to the source node of the message. The ICMP error response table contains two actions, "set_fake_icmp(fake_ip, fake_ttl)" and "no_action", where "set_fake_icmp(fake_ip, fake_ttl)" means discarding the original packet, and constructing an ICMP timeout message with fake_ip and fake_ttl as the source IP address and TTL and sending it to the source of the original packet; "no_action" is the default action, which means no processing is done and the packet is discarded. Figure 5 As shown in the figure, the detection data packet sent by the attacker's detection node H1 to H2 will enter the obfuscated node E from the E.eth1 interface. E.eth1 corresponds to E in the false topology. 1 .eth1, the controller will issue a table entry to instruct E to send an IP address of IP(E) to the source IP address of the data packet with E.eth1 as the input interface and TTL=1. 1 .eth1) and ICMP timeout message with TTL=63. In addition, since the detection packet with TTL=3 sent from H1 will enter the obfuscated node E from E.eth1 with TTL=2 and the virtual node E in the false topology 3 The controller will also issue a table entry to match the data packet with E.eth1 as the input interface, TTL=2 and the destination IP address H2.eth0, and send an IP address of IP(E 3 .eth2) and ICMP timeout message with TTL=62.

[0060] In one embodiment, the obfuscation node is used to execute customized topology obfuscation packet processing logic on the data plane, present false topology information to malicious detection packets and respond to normal detection packets with real topology information, including:

[0061] When a data packet arrives, the obfuscation node first distinguishes between normal detection packets and potential malicious detection packets by retrieving the detection node whitelist, responds to the normal detection packets with correct ICMP timeout messages, and fabricates and sends false ICMP timeout messages for potential malicious detection packets, and responds to false ICMP timeout messages for potential malicious detection packets with different TTL values ​​or executes TTL dynamic masquerade strategy.

[0062] In one of the embodiments, the TTL dynamic spoofing strategy indicates that the TTL field of the packet header is processed according to the length of the false path rather than the length of the real path. For the detection packet that will expire on the virtual node split from the obfuscation node, the obfuscation node will dynamically fill the TTL value for the ICMP timeout message so that the message is continuous when it arrives at the detection node.

[0063] In a specific embodiment, since there is a difference in length between the detection paths of the real physical network and the fake network, it is very likely that the attacker will determine the authenticity of the message by analyzing the value of the TTL field in the collected ICMP timeout message. In general, routers use a fixed TTL value, such as 64 or 128, to respond to each expired data packet. Once the obfuscated node also uses a fixed TTL value to respond to each expired malicious detection data packet, the value of the TTL field in the ICMP timeout message received by the attacker will be discontinuous, that is, the detection path length reflected by the TTL is inconsistent with the detection path collected by the attacker, which in turn causes the attacker to doubt the authenticity of the detection information and become aware of the defense of the target network. Figure 2 For example, suppose the attacker controls H1 to send a Traceroute probe packet to H2, and the obfuscated node E fills each ICMP timeout message with TTL=63 as the default value. 1 When the packet expires, it will trigger an ICMP timeout message with TTL=63 at the obfuscated node E. The message contains the information of the virtual node E. 1 The false IP address and TTL = 63. When the message passes through node A and reaches H1, the TTL is reduced to 62. Similarly, when the detection packet reaches the virtual node E 3 When the previous node expires, a new node containing virtual node E will also be triggered. 3 The false IP address and ICMP timeout message with TTL=63 are sent to H1. When the message reaches H1, the TTL is reduced to 62. 3 Compared to E 1 The distance between the two nodes is one hop away, but the TTL values ​​of the ICMP timeout messages returned by the two nodes when they arrive at H1 are the same, which will make the attacker doubt the authenticity of the detection path information.

[0064] To this end, the present application designs a TTL dynamic camouflage strategy to prevent attackers from discovering the target network's defenses based on the discontinuity of the TTL value. This mechanism processes the TTL field in the packet header based on the length of the fake path rather than the length of the real path. For probe packets that expire on the virtual nodes split from the obfuscated node, the obfuscated node will dynamically fill the TTL value for the ICMP timeout message so that the message is continuous when it reaches the probe node. For example, for the probe path H1→H2, at the virtual node E 1 Expired detection packets will trigger ICMP timeout messages with TTL=63, and virtual node E 3 Expired detection packets will trigger ICMP timeout messages with TTL=62 instead of TTL=63. 1 and E 3 The sent ICMP time exceeded messages will arrive at the detection node H1 with TTL=62 and TTL=61 respectively, thereby preventing the attacker from discovering the defense behavior of the target network due to the discontinuity of the TTL value of the ICMP time exceeded message.

[0065] As the TTL value increases, in addition to the packets whose TTL value expires at the obfuscated node, there will also be packets that only pass through the obfuscated node. In this case, the traditional router will reduce the TTL value by 1 and forward the packet to the next node. However, if the obfuscated node also adopts the same strategy, the TTL value of the detection packet will not expire at the expected node due to the inconsistency between the false topology and the underlying physical topology, resulting in the forged false topology not being exposed to the attacker as expected. In addition, for those packets that only pass through the obfuscated node but do not expire at the obfuscated node and whose source is not in the whitelist, the obfuscated node also adjusts the TTL value of such packets to prevent attackers from discovering the defense behavior of the target network. Figure 4 As shown in (a), when node E is not upgraded to a confusion node, malicious detection packets with TTL=1, 2, and 3 will expire at nodes A, E, and C respectively, and detection packets with TTL=4 will reach H2. When node E is upgraded to a confusion node, as shown in Figure 4 As shown in (b), the detection data packets with TTL=1, 2, and 3 will be sent to nodes A, E, respectively. 1 , E 3 When the obfuscated node E does not deploy TTL dynamic camouflage, the TTL of the packet with TTL=4 is reduced to 3 when it reaches the obfuscated node E, and E reduces the TTL to 2 and forwards it to the next hop node C. Therefore, the packet with TTL=4 will reach H2 instead of expiring at node C, causing node C to be skipped during detection. We call this phenomenon the node hopping problem. If the obfuscated node E deploys TTL dynamic camouflage, such as Figure 4As shown in (c), the data packet with TTL=4 will be forwarded by the obfuscated node E to the next hop node C with TTL=1 and will expire at C. At this time, the detection path is complete and accurate.

[0066] For non-probe packets whose source IP addresses are not in the whitelist, the obfuscation node also regards such packets as potential malicious probe messages. TTL dynamic camouflage can also prevent normal communication between hosts controlled by attackers. Because the difference in TTL of the sent packets after passing through the target network is inconsistent with the path length reflected by the detection path collected by the detection packets, the attacker will doubt the authenticity and accuracy of the detection information, prompting the attacker to identify the defense measures taken by the target network.

[0067] In one embodiment, the present application verifies why P4Obfu can effectively reduce the evaluation index. For a given target network G = (V, E), there is a key node v c , connected to n neighbor nodes To protect node v c , P4Obfu upgrades the node to a confused node and replaces it with n interconnected virtual nodes in the fake topology G′=(V′,E′) The virtual node Connect to neighbor nodes

[0068] Theorem 1: P4Obfu can effectively reduce the degree centrality of key nodes.

[0069] Proof: Because the key node v c There are n neighbor nodes in the target network, and their degree centrality can be calculated as To prove Theorem 1, we only need to show that in express The maximum value of the degree centrality of all virtual nodes in the pseudo topology. Have degree(vn i )=n. Therefore, for all have In addition, since node v c is replaced by n virtual nodes, with |V′|>|V|. Therefore, Theorem 1 is proved.

[0070] Theorem 2: P4Obfu can effectively reduce the close centrality of key nodes.

[0071] Proof: In the target network, the key node v c The closeness centrality of can be defined as Without loss of generality, when calculating from other nodes to node v c When the minimum number of hops is p i Paths passing through neighbor nodes Arrival node v c ,have Therefore, in the fake topology, for any virtual node There is p i Paths of constant length, where ∑ 1≤j≤n,j≠i p j The length of the path increases by 1, and there are (n-1) new paths of length 1. In addition, there are Then, there is In addition, for any node v∈V′, CC(v)≤1. In summary, we have Theorem 2 is proved.

[0072] Theorem 3: P4Obfu can effectively reduce the traffic-based betweenness centrality of key nodes. Proof: Assume that the path detection information collected by the attacker contains a total of p t detection paths, where p c Paths passing through key node v c . Node v c The flow-based betweenness centrality can be calculated as FBC(v c )=p c / p t .use Indicates that the subpath [nn i ,v c ,nn j ], where In addition, in the false topology, there is The detection path contains subpaths [nn i ,vn i ,vn j ,nn j ]. Therefore, for any virtual node have Obviously, there are Therefore, there is FBC (vn i )≤p c / p t =FBC(v c ), Theorem 3 is proved.

[0073] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0074] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A P4-based network topology obfuscation system that resists Traceroute. It is characterized in that The system includes a node selector, a topology forger, a configuration generator, and an obfuscation node; The node selector is used to identify key nodes in the target network using a plurality of pre-set evaluation indicators and calculate a node upgrade strategy for obfuscated nodes while satisfying cost constraints; The topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated node; The configuration generator is used to convert the false topology into the configuration information of the data packet processing logic of the obfuscated node by using the P4 program and send it to the obfuscated node to realize the deployment of the false topology on the data plane; The obfuscation node is used to execute customized topology obfuscation data packet processing logic on the data plane to present false topology information to malicious detection data packets and respond to normal detection data packets with real topology information.

2. The system according to claim 1, It is characterized in that The target network includes a set of nodes and a set of links; the evaluation indicators include degree centrality, flow-based betweenness centrality and closeness centrality; the degree centrality is used to describe the connection probability between a node and other nodes in the network, and is defined as where degree(v) represents the degree of node v; the flow-based betweenness centrality is an important indicator for identifying potential key nodes and is defined as Where F represents the set of detection traffic, tvs(f,x) is a binary variable. If it is equal to 1, it means that the routing path of the detection flow f passes through the node v. When identifying key nodes, all possible end-to-end paths with ingress / egress routers as source addresses and destination addresses are considered as potential detection paths for attackers, that is, |F| = n e (n e -1), where n e is the number of ingress / egress routers in the target network; the closeness centrality is where d v,u Represents the distance between nodes v and u.

3. The system according to claim 1, It is characterized in that The node upgrade strategy of calculating the obfuscated node under the condition of satisfying the cost constraint includes: Use G = (V, E) to represent the target network topology, where V is the set of nodes in the target network, E is the set of links in the target network, B is the update budget of the network manager, and c is the update budget of the network manager. i Indicates that the node v i ∈V is the upgrade cost required to upgrade to a confusing node, represented by a binary variable x i Represents node v i ∈V is selected to be upgraded to a confusion node if x i =1 means node v i Selected to upgrade to obfuscation node: ∑x i c i ≤B For each node v i ∈V, using multiple evaluation indicators to comprehensively evaluate the critical score CS(v i ) is CS(v i )=α·DC(v i )+β·FBC(v i )+γ·CC(v i ), Among them, α, β, and γ are weight coefficients that can be adjusted by the network administrator, and α+β+γ=1; The optimization objective is to maximize the sum of the criticality scores of the obfuscated nodes, and the node upgrade problem is modeled as an integer linear programming model: s.t.(2-1),(2-2) The integer linear programming model is solved using a greedy node selection algorithm to calculate each node v i ∈V value density τ i Afterwards, each node is traversed in descending order of value density, and the node is upgraded to a confused node within the upgrade cost constraint.

4. The system according to claim 1, It is characterized in that The topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated node, including: Each obfuscated node in the target network is split into multiple interconnected virtual nodes through the node splitting method, and the criticality of the obfuscated node is evenly distributed to each virtual node.

5. A system according to any one of claims 1 to 4, It is characterized in that Converting the false topology into the configuration information of the data packet processing logic of the obfuscation node and sending it to the obfuscation node to deploy the false topology before the data plane, further comprising: The obfuscation node will save the detection node whitelist, which contains the information of the measurement nodes controlled by the network administrator. The detection node whitelist will match the source IP address field in the data packet header as a keyword. If the data packet is sent by a node in the detection node whitelist, it will be identified as a normal detection data packet and forwarded according to the normal data packet processing logic; otherwise, all data packets that are not matched by the detection node whitelist will be considered as potential malicious detection data packets and the TTL dynamic camouflage strategy or ICMP error response will be executed according to the TTL value.

6. The system according to claim 5, It is characterized in that The configuration generator is used to convert the false topology into the configuration information of the data packet processing logic of the obfuscated node by using the P4 program and send it to the obfuscated node to deploy the false topology on the data plane, including: The data plane packet processing logic is developed using the P4 program, and the detection node whitelist and ICMP error response are encoded into two "match-action" tables. Each "match-action" table consists of "key" and "actions", where "key" reveals which fields in the data packet are matched, and "actions" represents a collection of actions. The entries in the "match-action" table indicate how to process the data packet, that is, when the "key" field in the header of the data packet hits a table entry, the data packet is processed according to the action corresponding to the table entry; otherwise, the data packet is processed according to the default action, and the false topology is converted into a specific "match-action" table entry and sent to the corresponding obfuscation node to implement the deployment of the false topology.

7. The system according to claim 6, It is characterized in that The obfuscation node is used to execute customized topology obfuscated data packet processing logic on the data plane, present false topology information to malicious detection data packets and respond to normal detection data packets with real topology information, including: When a data packet arrives, the obfuscation node first distinguishes between normal detection packets and potential malicious detection packets by retrieving the detection node whitelist, responds to the normal detection packets with correct ICMP timeout messages, and fabricates and sends false ICMP timeout messages for potential malicious detection packets, and responds to false ICMP timeout messages for potential malicious detection packets with different TTL values ​​or executes TTL dynamic masquerade strategy.

8. The system according to claim 7, It is characterized in that The TTL dynamic camouflage strategy means processing the TTL field of the data packet header according to the length of the false path rather than the length of the real path. For the detection data packet that will expire on the virtual node split from the obfuscation node, the obfuscation node will dynamically fill the TTL value for the ICMP timeout message so that the message is continuous when it arrives at the detection node.

9. The system according to claim 5, It is characterized in that The ICMP error response indicates discarding the data packet that triggers the obfuscation node to execute the ICMP error response and sending an ICMP timeout message containing the IP address of the virtual node and a false TTL value to the source of the malicious detection data packet.

Images