P4-based Anti-Traceroute Network Topology Obfuscation System

Abstract

This application relates to a P4-based traceroute-resistant network topology obfuscation system. The system includes a node selector, a topology forger, a configuration generator, and an obfuscation node. The node selector is configured to identify key nodes in a target network using multiple evaluation metrics and calculate node upgrade policies for the obfuscation nodes while satisfying cost constraints. The topology forger is configured to construct a false topology based on the target network topology and the node upgrade policies for the obfuscation nodes. The configuration generator is configured to utilize a P4 program to convert the false topology into configuration information for the obfuscation node's packet processing logic and distribute it to the obfuscation node to deploy the false topology on the data plane. The obfuscation node is configured to execute customized topology obfuscation packet processing logic on the data plane, presenting false topology information to malicious probe packets and responding to normal probe packets with true topology information. This system can improve network security.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a P4-based anti-Traceroute network topology obfuscation system. Background Art

[0002] Traceroute is a standard path tracing tool, primarily used to display detailed, hop-by-hop information (such as the IP addresses of intermediate routers) along the path a packet takes between hosts. It explores the routing path by sending a series of probe packets with increasing TTL values ​​from the source to the destination. When a packet arrives at a router, the router first checks whether the packet's TTL value is equal to 1. If so, it discards the packet and sends an ICMP Time Exceeded message containing the IP address of the router's inbound interface to prevent the packet from looping indefinitely within the network. If not, the router decrements the packet's TTL value by 1 and forwards it to the next-hop router. Therefore, based on the forwarding rules described above, starting with TTL = 1, the source sends probe packets with increasing TTL values, then receives ICMP Time Exceeded messages from internal devices, until the probe packets reach the destination. Traceroute can also measure the round-trip time (RTT) of the path using the time difference between sending a packet and receiving the corresponding ICMP Time Exceeded message. Because attackers need to receive response messages sent by forwarding devices within the target network to infer the network topology, traceroute-based systems are also called internal collaborative topology inference or explicit topology inference. By combining multiple source-destination probe paths, attackers can obtain a complete topology, where each node represents an IP address. This topology is called interface-level topology or IP-level topology. However, a router typically has many interfaces, each with a separate IP address. Therefore, the interface-level topology cannot reflect the underlying physical topology. To do this, attackers need to merge different interfaces belonging to the same router into a single router node, an operation known as alias resolution.

[0003] Existing alias resolution technologies can be divided into two categories based on whether additional probe packets need to be sent: 1) Packet-based alias resolution technologies require sending additional probe packets to check whether two IP addresses belong to the same router. This type of alias resolution technology analyzes the specific content contained in the response message of the additional probe packet, such as the source IP address and IP header options in the ICMP message. 2) Graph-based alias resolution technologies analyze path information without sending additional probe packets. For example, different IP addresses that can reach the same IP address are aliases of each other, while IP addresses in the same probe path are not aliases of each other. After alias resolution is completed, each node in the probe topology represents an independent network device. This is called a router-level topology, which can be used to infer key node and link information of the target network. An attacker can construct an interface-level topology by merging the same node and link information in the collected path information. In order to obtain the underlying physical network structure, the attacker can use alias resolution technology to convert the interface-level topology into a router-level topology. Router-level topology can help attackers locate key nodes and links in the target network, thereby building a cost-effective attack strategy. After finding some key nodes and links, the attacker launches flooding on a small number of key links to cut off the victim's network communications within a certain range.

[0004] Currently, link flooding attacks have caused severe damage to the global Internet. To address this problem, programmable routers can attempt to hide and obfuscate specific links by modifying ICMP messages, preventing attackers from identifying valid targets. However, systems that only obfuscate IP addresses and create simple virtual paths cannot effectively obfuscate the importance of links. Even if link names and codes are changed, attackers can still identify the location of links in the topology, assess their importance, and successfully launch attacks, threatening network availability. Summary of the Invention

[0005] Based on this, it is necessary to provide a P4-based anti-Traceroute network topology obfuscation system that can improve network security in response to the above technical problems.

[0006] A P4-based traceroute-resistant network topology obfuscation system, comprising a node selector, a topology forger, a configuration generator, and obfuscation nodes;

[0007] The node selector is used to identify key nodes in the target network using multiple pre-set evaluation indicators and calculate the node upgrade strategy for obfuscated nodes while meeting the cost constraint;

[0008] The topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated nodes;

[0009] The configuration generator is used to convert the false topology into the configuration information of the packet processing logic of the obfuscation node using the P4 program and send it to the obfuscation node to deploy the false topology on the data plane;

[0010] The obfuscation node is used to perform customized topology obfuscation packet processing logic on the data plane to present false topology information to malicious probe packets and respond to normal probe packets with true topology information.

[0011] The aforementioned P4-based traceroute-resistant network topology obfuscation system first uses multiple pre-set evaluation indicators to identify key nodes in the target network and calculates a node upgrade strategy for the obfuscated nodes while meeting cost constraints. This prioritizes upgrading highly critical nodes in the target network to obfuscated nodes, i.e., obfuscated nodes. Then, based on the target network topology and the obfuscated node upgrade strategy, a false topology with a balanced distribution of criticality is constructed, creating a more secure false topology for attackers. The false topology is then converted into configuration information for the obfuscated node's packet processing logic using a P4 program and sent to the obfuscated node to deploy the false topology on the data plane. A new probe packet processing logic is designed for the obfuscated node, which modifies passing probe packets and returns a false ICMP timeout message for expired probe packets, presenting attackers with a false topology that hides key nodes, thereby significantly improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 1. A schematic diagram of a flow chart of a P4-based anti-Traceroute network topology obfuscation system in one embodiment;

[0013] Figure 2 A schematic diagram of a node splitting process in one embodiment;

[0014] Figure 3 A flowchart illustrating customized data packet processing logic in an obfuscation node according to one embodiment;

[0015] Figure 4 Figure 1 is a schematic diagram of a TTL dynamic camouflage strategy in another embodiment; wherein (a) is a probe packet route map when node E has not been upgraded to an obfuscated node, (b) is a probe packet route map when node E has not been upgraded to an obfuscated node, and (c) is a probe packet route map when node E has been upgraded to an obfuscated node and TTL dynamic camouflage has been deployed;

[0016] Figure 5A flowchart of an embodiment in which a configuration generator automatically generates and issues a configuration for an obfuscated node based on a real physical network and a fake topology. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0018] In one embodiment, a P4-based traceroute-resistant network topology obfuscation system is provided, comprising a node selector, a topology forger, a configuration generator, and an obfuscation node;

[0019] The node selector is used to identify key nodes in the target network using multiple pre-set evaluation indicators and calculate the node upgrade strategy for obfuscated nodes while meeting the cost constraint;

[0020] The topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated nodes;

[0021] The configuration generator is used to convert the false topology into the configuration information of the packet processing logic of the obfuscation node using the P4 program and send it to the obfuscation node to deploy the false topology on the data plane;

[0022] The obfuscation node is used to perform customized topology obfuscation packet processing logic on the data plane to present false topology information to malicious probe packets and respond to normal probe packets with true topology information.

[0023] In the above-mentioned P4-based anti-Traceroute network topology obfuscation system, Figure 1As shown, the system consists of four modules: a node selector, a topology forger, obfuscated nodes, and a configuration generator. It prioritizes the deployment of defense mechanisms for high-criticality nodes through a comprehensive evaluation metric system. It also utilizes customized data plane processing logic based on the P4 program to fabricate false ICMP timeout messages for attackers, disrupting their traceroute-based topology inference. The node selector is responsible for identifying critical nodes in the network and developing node upgrade strategies while meeting cost constraints. This module utilizes a combination of multiple evaluation metrics to measure node criticality, maximizing protection effectiveness while meeting cost constraints. The topology forger constructs a fake topology with a balanced criticality distribution based on the target network topology and the obfuscated node deployment plan, thereby concealing critical nodes. This module uses a node splitting method to split each obfuscated node in the real network into multiple virtual nodes in the fake topology, distributing the criticality of the obfuscated node across the virtual nodes. The configuration generator, based on the fake topology and real network information, delivers corresponding configuration information to the obfuscated node's packet processing logic, enabling the deployment of the fake topology on the data plane. Based on the target network's topology and forwarding behavior, this module converts the false topology into specific configuration information and distributes it to each obfuscation node to guide it in identifying and manipulating potentially malicious packets. The obfuscation node is responsible for hiding the obfuscation node from attackers on the data plane and maintaining Traceroute's availability for its own side. The obfuscation node converts the false topology generated by the topology forger into customized packet processing logic on the data plane. When a packet arrives, the obfuscation node first distinguishes between normal probe packets and potentially malicious packets by searching the whitelist. It responds with a correct ICMP timeout message for normal probe packets and fabricates and sends an erroneous ICMP timeout message for potentially malicious packets. Furthermore, the obfuscation node employs a TTL dynamic camouflage strategy to prevent attackers from discovering the target network's defensive behavior due to TTL discontinuities in received ICMP timeout messages.

[0024] In one embodiment, the target network includes a set of nodes and a set of links; the evaluation indicators include degree centrality, flow-based betweenness centrality, and closeness centrality; degree centrality is used to describe the probability of a node being connected to other nodes in the network and is defined as where degree(v) represents the degree of node v; flow-based betweenness centrality is an important indicator for identifying potential key nodes and is defined as Where F represents the set of probe traffic, tvs(f,x) is a binary variable. If it is equal to 1, it means that the routing path of the probe flow f passes through the node v. When identifying key nodes, all possible end-to-end paths with the ingress / egress router as the source address and destination address are considered as potential probe paths for the attacker, that is, |F| = ne (n e -1), where n e is the number of ingress / egress routers in the target network; the closeness centrality is where d v,u Represents the distance between nodes v and u.

[0025] In a specific embodiment, the node selector is responsible for accurately identifying potential critical nodes in the target network and prioritizing upgrading highly critical nodes to obfuscated nodes while meeting cost constraints. For a given target network G = (V, E), where V represents the set of nodes in the network and E represents the set of links in the network, the following evaluation metrics are used to measure the criticality of the nodes:

[0026] The degree of a node is an important indicator for identifying key nodes. It measures the number of neighboring nodes of a node. The larger the degree of a node, the more edges and nodes it is associated with. Therefore, once a node with a high degree in the network fails, the failure will affect the forwarding function of multiple nodes around it, resulting in a decrease in network performance. Degree Centrality (DC) is used to describe the probability of a node being connected to other nodes in the network and is defined as Where degree(v) represents the degree of node v.

[0027] Since many networks calculate end-to-end routing paths based on the shortest paths, a failure of a node passed by multiple shortest paths may cause multiple routing paths to fail. Betweenness Centrality (BC) is used to measure the number of shortest paths passing through the same node. Although an attacker may be able to discover all forwarding devices in the target network, the attacker cannot discover all possible routing paths because the attacker cannot invade every device in the target network. The attacker can only obtain limited routing information by probing the information contained in the path. Inspired by flow density, this application proposes flow-based betweenness centrality (FBC) as an important indicator for identifying potential key nodes, and defines it as Where F represents the set of probe traffic, and tvs(f,x) is a binary variable that, if equal to 1, indicates that the routing path of the probe flow f passes through node v. However, before the attacker begins probing, it is difficult for the target network to predict the location of the attacker's probing hosts and the probing traffic they send. To this end, when identifying key nodes, we consider all possible end-to-end paths with ingress / egress routers as source and destination addresses as potential probing paths for the attacker, i.e., |F| = n e (n e -1), where n eis the number of ingress / egress routers in the target network.

[0028] Network bottlenecks usually occur at the center of the network. Therefore, nodes located in the center are more likely to be potential key nodes. In other words, the smaller the average distance between a node and other nodes, the higher its criticality. In addition, in a network, the distance can be calculated as the minimum number of hops required between two nodes. Therefore, this application defines closeness centrality (CC) as where d v,u Represents the distance (number of hops) between nodes v and u.

[0029] In one embodiment, because upgrading all devices in the network will result in high deployment and management costs, network managers often do not upgrade network devices on a large scale. Instead, they prioritize upgrading critical nodes within the cost budget. To this end, considering the cost constraint, this application models the node upgrade problem as an integer linear programming problem.

[0030] Calculate the node upgrade strategy of the obfuscated node while meeting the cost constraint, including:

[0031] Use G = (V, E) to represent the target network topology, where V is the set of nodes in the target network, E is the set of links in the target network, B is the update budget of the network manager, and c is the update budget of the network manager. i Indicates that the node v i ∈V is the upgrade cost required to upgrade to a confusing node, represented by a binary variable x i Represents node v i ∈V is selected to be upgraded to a confusion node if x i =1 means node v i Selected to upgrade to obfuscation node

[0032] ∑x i c i ≤B

[0033] For each node v i ∈V, using multiple evaluation indicators to comprehensively evaluate the critical score CS(v i )for

[0034]

[0035] Among them, α, β, and γ are weight coefficients that can be adjusted by the network administrator, and α+β+γ=1;

[0036] The optimization objective is to maximize the sum of the criticality scores of the obfuscated nodes, and the node upgrade problem is modeled as an integer linear programming model:

[0037]

[0038] The greedy node selection algorithm is used to solve the integer linear programming model and calculate the v of each node. i ∈V value density τ i Afterwards, each node is traversed in descending order of value density, and nodes are upgraded to obfuscated nodes within the upgrade cost constraint.

[0039] In a specific embodiment, the node upgrade problem can be considered a variant of the 0-1 knapsack problem, where the criticality score is set to the value of the item and the update budget is considered to be the weight of the item. Therefore, the node upgrade problem is NP-hard, requiring the design of a heuristic algorithm to handle large-scale problems. To this end, this application designs a greedy node selection algorithm to solve this problem. The pseudo code for the algorithm is shown in Table 1 below:

[0040] Table 1

[0041]

[0042] The core of this algorithm is to prioritize upgrading nodes with higher value density to obfuscated nodes. Value density is the ratio of criticality score to upgrade cost. Therefore, the algorithm first calculates the value of each node v i ∈V value density τ i Afterwards, each node is traversed in descending order of value density, and nodes are upgraded to obfuscated nodes within the upgrade cost constraint.

[0043] In one embodiment, a topology forger is used to construct a fake topology with balanced criticality distribution based on a target network topology and a node upgrade strategy of an obfuscated node, including:

[0044] Each obfuscated node in the target network is split into multiple interconnected virtual nodes through the node splitting method, and the criticality of the obfuscated node is evenly distributed to each virtual node.

[0045] In a specific embodiment, the topology forger is responsible for generating a fake topology with balanced node criticality based on the real network topology to confuse the attacker's topology inference. To this end, P4Obfu splits the obfuscated node in the real network into multiple interconnected virtual nodes in the fake topology. This application refers to this process as node splitting. The insight behind node splitting is to use multiple virtual nodes to share the criticality of the obfuscated node, and then hide the obfuscated node in the fake topology. For each obfuscated node, the virtual nodes generated by the node split are connected by virtual links. The number of virtual nodes depends on the degree of the obfuscated node in the real network. Assume that there is a obfuscated node v in the target network. i, its degree is n, and its neighbor node is Then, in the fake topology, the obfuscated node will be split into n virtual nodes Each virtual node is connected to one of its neighbor nodes, namely virtual node vn i With neighbor node nn i In addition, virtual nodes are connected to each other, that is, for any virtual node vn i , which is connected to the rest of the virtual nodes There is a virtual link between them. Each virtual node in the fake topology will be presented to the attacker by responding to the attacker's probe packet with an erroneous ICMP timeout message. Figure 2 As shown, there is a confusing node E with a degree of 4 in the network, and its neighbors are A, B, C, and D. In order to hide the confusing node E, the topology forger splits E into 4 interconnected virtual nodes E in the fake topology. 1 , E 2 , E 3 , E 4 , the dotted lines between virtual nodes represent virtual links. In addition, each virtual node is connected to one of the neighboring nodes of the obfuscated node, such as virtual node E 1 Connected to neighbor node A.

[0046] Topology forgers use node splitting to design fake topologies for two reasons: 1) Due to deployment costs, network administrators find it difficult to deploy topology obfuscation mechanisms for all forwarding devices in the network. Therefore, when only a small number of devices in the network have obfuscation capabilities, obfuscation can only be performed after the probe packet passes through the obfuscated node. Furthermore, since the probe path is bidirectional, an attacker can control any probe node at either end of the path to send a probe packet to the other probe node. This makes the non-obfuscated nodes on both sides of the obfuscated node visible to the attacker. Therefore, only the obfuscated node itself can be hidden, not the entire probe path. To this end, topology forgers split a single obfuscated node into multiple virtual nodes to distribute the criticality of the obfuscated node and achieve the goal of hiding critical nodes. Furthermore, topology forgers interconnect virtual nodes belonging to the same obfuscated node, ensuring that each probe record passes through at most two virtual nodes, thus evenly distributing the probe flow to each virtual node. 2) Unlike NetHide, P4Obfu does not alter the routing path of potentially malicious packets when designing fake topologies; it simply uses node splitting to hide the obfuscated nodes. This is because rerouting malicious packets will conflict with the existing load balancing mechanism in the network. In contrast, the virtual nodes and virtual links generated by the topology forger do not actually exist in the network. Instead, by confusing the nodes with the attacker's malicious packets and responding with incorrect ICMP timeout messages, the attacker mistakenly believes the fake topology is the actual physical structure of the target network. This makes the fake topology generated by node splitting unnecessary to make a trade-off between security and load balancing.

[0047] In one embodiment, converting the false topology into configuration information of the packet processing logic of the obfuscation node and sending the configuration information to the obfuscation node to deploy the false topology before the data plane further includes:

[0048] The obfuscation node will save the detection node whitelist, which contains the information of the measurement nodes controlled by the network administrator. The detection node whitelist will match the source IP address field in the data packet header as a keyword. If the data packet is sent by a node in the detection node whitelist, it will be considered a normal detection data packet and forwarded according to the normal data packet processing logic; otherwise, all data packets that are not matched by the detection node whitelist will be considered as potential malicious detection data packets and the TTL dynamic camouflage strategy or ICMP error response will be executed according to the TTL value.

[0049] In one embodiment, the ICMP error response indicates discarding the data packet that triggers the obfuscation node to execute the ICMP error response and sending an ICMP timeout message containing the IP address of the virtual node and a false TTL value to the source of the malicious probe data packet.

[0050] In a specific embodiment, the obfuscation node is responsible for executing customized topology obfuscation packet processing logic on the data plane to present false topology information to malicious packets and respond to normal detection packets with true topology information. Figure 3 A schematic diagram of the customized packet processing logic in the obfuscation node is given. When the data packet arrives at the obfuscation node, normal detection packets and potential malicious packets are distinguished by whitelist matching. Normal packet processing logic is executed for normal detection packets, such as TTL reduction by 1 and forwarding to the next node. For potential malicious detection packets with different TTL values, an erroneous ICMP timeout message is responded or TTL dynamic camouflage is performed.

[0051] First, to distinguish between normal and malicious probe traffic, the obfuscation node maintains a whitelist of probe nodes, which contains information about measurement nodes controlled by the network administrator. This whitelist uses the source IP address field in the packet header as a keyword for matching. If the packet is sent from a node on the whitelist, it is considered a normal probe packet and forwarded according to normal packet processing logic. Otherwise, all packets not matched by the whitelist are considered potential malicious probe packets (including non-probe packets that have not expired on internal devices within the target network but whose source IP addresses are not on the whitelist), and TTL dynamic masquerading or ICMP error responses are performed based on the TTL value.

[0052] This application discovered that in addition to sending probe traffic between the attacker's probe nodes, there will also be normal business traffic to exchange information or cover the sending of probe traffic. Since the false topology generated by the topology forger is different from the real physical network, especially the end-to-end path length. Therefore, if the obfuscation operation is not performed on such non-probe data packets and only the malicious probe data packets are obfuscated, the network topology information implicit in the normal business traffic will be inconsistent with the network topology information collected by the probe traffic. For example, the difference in TTL between when the data packet is sent from the source and when it is received by the destination is inconsistent with the probe path length reflected by the probe data packet, which will undoubtedly make the attacker doubt the authenticity and accuracy of the probe information. Therefore, P4Obfu also regards non-probe data packets whose source IP addresses are not in the whitelist as potential probe data packets and takes obfuscation measures to prevent attackers from noticing the defensive behavior of the target network.

[0053] Traceroute-based topology inference exploits the characteristics of the ICMP protocol to cause probe packets to expire at each intermediate node along the probe path, triggering the return of an ICMP Time Exceeded message. Attackers then gather the IP address information contained in these ICMP Time Exceeded messages to construct a probe topology. Therefore, the control plane first assigns a spoofed IP address to each virtual network interface of the virtual nodes created by the obfuscation node. This ensures that when a malicious packet expires at a virtual node and triggers an ICMP Time Exceeded message, the assigned spoofed IP address is inserted into the ICMP Time Exceeded message and sent to the attacker. To this end, the obfuscation node further determines whether the potentially malicious probe packet will expire at a virtual node created by the obfuscation node. If so, the obfuscation node is responsible for inserting the virtual node information into the ICMP Time Exceeded message header and returning it to the attacker. Furthermore, since virtual nodes do not actually exist in the underlying physical network, both traceroute probe packets and ICMP Time Exceeded messages are forwarded according to the actual network topology. While the spoofed IP addresses contained in the ICMP Time Exceeded messages expose the spoofed topology to the attacker, they do not actually alter the physical structure and routing paths of the actual network.

[0054] Due to node splitting, every time a malicious packet passes through a confused node, the length of its detection path increases by 1. Figure 2 For example, suppose the attacker connects two probe nodes H1 and H2 to nodes A and C respectively, and controls H1 to send traceroute probe packets to H2. Without deploying any defense strategy, the attacker will obtain a probe path of length 5 (H1-AEC-H2). After upgrading node E to a confused node, the attacker will obtain a probe path of length 6 (H1-AE 1 -E 3 -C-H2). Therefore, the obfuscation node uses TTL ≤ 2 to determine whether a malicious packet will expire on the virtual node it splits, rather than TTL ≤ 1. When a malicious probe packet arrives at the obfuscation node with TTL ≤ 2, the obfuscation node triggers an ICMP error response: it discards the packet and sends an ICMP time-exceeded message containing the virtual node's IP address and a false TTL value to the source of the malicious probe packet.

[0055] In one embodiment, a configuration generator is configured to convert a false topology into configuration information of a packet processing logic of an obfuscation node using a P4 program and send the configuration information to the obfuscation node to deploy the false topology on the data plane, including:

[0056] The data plane packet processing logic is developed using the P4 program, and the detection node whitelist and ICMP error response are encoded into two "match-action" tables. Each "match-action" table consists of "key" and "actions", where "key" reveals which fields in the packet are matched, and "actions" represents a set of actions. The entries in the "match-action" table indicate how to process the packet. That is, when the "key" field in the packet header hits a table entry, the packet is processed according to the action corresponding to the table entry; otherwise, the packet is processed according to the default action. The false topology is converted into a specific "match-action" table entry and sent to the corresponding obfuscation node to implement the deployment of the false topology.

[0057] In a specific embodiment, the configuration generator is responsible for converting the false topology generated by the topology forger into the configuration information of the packet processing logic of the obfuscated node and sending it to the obfuscated node. In this application, the P4 program is used to develop the packet processing logic of the data plane, and the aforementioned node whitelist and ICMP error response are encoded into two "match-action" tables. Each "match-action" table consists of "key" and "actions", where "key" reveals which fields in the data packet are matched, and "actions" represents a set of actions. The entries in the "match-action" table reveal how to process the data packet, that is, when the "key" field in the header of the data packet hits a table entry, the data packet is processed according to the action corresponding to the table entry; otherwise, the data packet is processed according to the default action. Therefore, if Figure 5 As shown in Figure 1, the configuration generator converts the fake topology into entries in a specific "match-action" table and sends it to the corresponding obfuscation node to implement the fake topology deployment. The P4 program deployed on the obfuscation node contains many tables to support the normal operation of the network. This section only describes the tables related to network topology obfuscation.

[0058] The node whitelist uses the source IP address of the data packet as a keyword to match the data packet, and is used to classify the data packet into normal probe packets and potential malicious packets. The node whitelist contains two actions "normal_packet" and "probe_packet", where "normal_packet" means marking the data packet as a normal probe packet, and "probe_packet" means marking the data packet as a potential malicious packet. The configuration generator uses the IP address of the network interface of the legitimate probe node as the keyword of the table entry, and sets the action of the corresponding entry to "normal_packet". In addition, the default action is set to "probe_packet" to treat all traffic sent by illegal probe nodes as potential malicious packets. Figure 5As shown, D1 is the network administrator's measurement node. Therefore, the controller sends the IP address of D1's interface eth0 as a whitelist entry to obfuscation node E. Whenever an incoming packet's source IP address matches this entry, the packet is identified as a normal probe packet. Otherwise, the default action is taken, marking all packets that do not match this entry as potential probe packets.

[0059] The ICMP error response table uses the packet's input interface, destination IP address, and TTL as keywords to match packets. It is used to construct an ICMP timeout message for packets with TTL ≤ 2 and marked as "probe_packet", and returns it to the source node of the message. The ICMP error response table contains two actions, "set_fake_icmp(fake_ip, fake_ttl)" and "no_action", where "set_fake_icmp(fake_ip, fake_ttl)" means discarding the original packet, and constructing an ICMP timeout message with fake_ip and fake_ttl as the source IP address and TTL and sending it to the source of the original packet; "no_action" is the default action, which means no processing is done and the packet is discarded. Figure 5 As shown, the detection data packet sent by the attacker's detection node H1 to H2 will enter the obfuscated node E from the E.eth1 interface. E.eth1 corresponds to E in the false topology. 1 .eth1, the controller will issue a table entry to instruct E to send an IP address of IP(E 1 .eth1) and ICMP timeout message with TTL=63. In addition, since the probe packet with TTL=3 sent from H1 will enter the obfuscated node E from E.eth1 with TTL=2 and the virtual node E in the false topology 3 When the time expires, the controller will also send a table entry to match the data packet with E.eth1 as the input interface, TTL=2 and the destination IP address as H2.eth0, and send an IP address of IP(E 3 .eth2) and ICMP time exceeded message with TTL=62.

[0060] In one embodiment, the obfuscation node is configured to execute customized topology obfuscation packet processing logic on the data plane, present false topology information to malicious probe packets, and respond to normal probe packets with true topology information, including:

[0061] When a data packet arrives, the obfuscation node first distinguishes between normal probe packets and potential malicious probe packets by retrieving the probe node whitelist, responding with correct ICMP timeout messages for normal probe packets and fabricating and sending false ICMP timeout messages for potential malicious probe packets, and responding with false ICMP timeout messages for potential malicious probe packets with different TTL values ​​or executing TTL dynamic masquerade strategy.

[0062] In one embodiment, the TTL dynamic masquerading strategy indicates processing the TTL field of the packet header based on the length of the false path rather than the length of the real path. For the detection packet that will expire on the virtual node split from the obfuscation node, the obfuscation node will dynamically fill the TTL value for the ICMP timeout message so that the message is continuous when it arrives at the detection node.

[0063] In a specific embodiment, due to the difference in length between the detection paths of the real physical network and the fake network, it is very likely that the attacker will determine the authenticity of the message by analyzing the value of the TTL field in the collected ICMP timeout message. Generally, the router will use a fixed TTL value, such as 64 or 128, to respond to each expired data packet. Once the obfuscated node also uses a fixed TTL value to respond to each expired malicious detection data packet, the value of the TTL field in the ICMP timeout message received by the attacker will be discontinuous, that is, the detection path length reflected by the TTL is inconsistent with the detection path collected by the attacker, which will cause the attacker to doubt the authenticity of the detection information and perceive the defense of the target network. Figure 2 For example, suppose the attacker controls H1 to send a Traceroute probe packet to H2, and the obfuscated node E fills each ICMP timeout message with TTL=63 as the default value. When the probe packet is in the virtual node E 1 When the time expires, the data packet will trigger an ICMP timeout message with TTL=63 at the obfuscated node E. The message contains the virtual node E 1 The false IP address and TTL = 63. When the message passes through node A and reaches H1, the TTL is reduced to 62. Similarly, when the probe packet reaches the virtual node E 3 When the previous one expires, it will also trigger a virtual node E 3 The false IP address and ICMP timeout message with TTL=63 are sent. When the message reaches H1, the TTL is reduced to 62. 3 Compared with E 1 The distance between the two nodes is one hop away, but the TTL values ​​of the ICMP timeout messages returned by the two nodes when they reach H1 are the same, which will make the attacker doubt the authenticity of the detection path information.

[0064] To this end, this application designs a TTL dynamic camouflage strategy to prevent attackers from discovering the target network's defenses based on the discontinuity of the TTL value. This mechanism processes the TTL field in the packet header based on the length of the false path rather than the length of the real path. For probe packets that expire on the virtual nodes split from the obfuscation node, the obfuscation node will dynamically fill the TTL value for the ICMP timeout message so that the message is continuous when it reaches the probe node. For example, for the probe path H1→H2, at the virtual node E 1 Expired probe packets will trigger ICMP timeout messages with TTL=63, and virtual node E 3 Expired probe packets will trigger ICMP timeout messages with TTL=62 instead of fixed TTL=63. 1 and E 3 The ICMP time exceeded messages sent will arrive at the detection node H1 with TTL=62 and TTL=61 respectively, thereby preventing the attacker from discovering the defense behavior of the target network due to the discontinuity of the TTL value of the ICMP time exceeded message.

[0065] As the TTL value increases, in addition to the packets whose TTL value expires at the obfuscation node, there will also be packets that only pass through the obfuscation node. In this case, the traditional router will reduce the TTL value by 1 and forward the packet to the next node. However, if the obfuscation node also adopts the same strategy, the TTL value of the detection packet will not expire at the expected node due to the inconsistency between the false topology and the underlying physical topology, resulting in the forged false topology not being exposed to the attacker as expected. In addition, for those packets that only pass through the obfuscation node but do not expire at the obfuscation node and whose source is not in the whitelist, the obfuscation node also adjusts the TTL value of such packets to prevent attackers from discovering the defense behavior of the target network. Figure 4 As shown in (a), when node E is not upgraded to a confused node, malicious probe packets with TTL=1, 2, and 3 will expire at nodes A, E, and C respectively, and probe packets with TTL=4 will reach H2. When node E is upgraded to a confused node, as shown in Figure 4 As shown in (b), the detection data packets with TTL=1, 2, and 3 will be sent to nodes A, E, and 1 , E 3 Expiration, when the obfuscation node E does not deploy TTL dynamic camouflage, the TTL of the data packet with TTL=4 is reduced to 3 when it reaches the obfuscation node E and E reduces the TTL to 2 and forwards it to the next hop node C. Therefore, the data packet with TTL=4 will reach H2 instead of expiring at node C, causing node C to be skipped during detection. We call this phenomenon the node hopping problem. If the obfuscation node E deploys TTL dynamic camouflage, such as Figure 4As shown in (c), the data packet with TTL=4 will be forwarded by the obfuscated node E to the next hop node C with TTL=1 and will expire at C. At this time, the detection path is complete and accurate.

[0066] For non-probe packets whose source IP addresses are not on the whitelist, the obfuscation node also treats them as potentially malicious probes. TTL dynamic spoofing can also prevent normal communication between hosts controlled by an attacker. Because the difference between the TTL of the outgoing packet after traversing the target network and the path length reflected by the probe packet's detection path are inconsistent, attackers may doubt the authenticity and accuracy of the probe information, prompting them to identify the defensive measures implemented by the target network.

[0067] In one embodiment, this application verifies why P4Obfu can effectively reduce the evaluation index. For a given target network G = (V, E), there is a key node v c , connected to n neighbor nodes To protect node v c , P4Obfu upgrades the node to a confused node and replaces it with n interconnected virtual nodes in the fake topology G′=(V′,E′) The virtual node Connect to neighbor nodes

[0068] Theorem 1: P4Obfu can effectively reduce the degree centrality of key nodes.

[0069] Proof: Because the key node v c There are n neighbor nodes in the target network, and their degree centrality can be calculated as To prove Theorem 1, we only need to show that in express The maximum value of the degree centrality of all virtual nodes in the pseudo topology. In the pseudo topology, for any virtual node Have degree(vn i )=n. Therefore, for all have In addition, since node v c is replaced by n virtual nodes, with |V′|>|V|. Therefore, Theorem 1 is proved.

[0070] Theorem 2: P4Obfu can effectively reduce the close centrality of key nodes.

[0071] Proof: In the target network, the key node v c The closeness centrality of can be defined as Without loss of generality, when calculating from other nodes to node v c When the minimum number of hops is p i Paths passing through neighbor nodes Arrival node v c ,have Therefore, in the fake topology, for any virtual node There is p i paths of constant length, where ∑ 1≤j≤n,j≠i p j The length of the path increases by 1, and there are (n-1) new paths of length 1. In addition, there are Then, there is In addition, for any node v∈V′, CC(v)≤1. In summary, we have Theorem 2 is proved.

[0072] Theorem 3: P4Obfu can effectively reduce the traffic-based betweenness centrality of key nodes. Proof: Assume that the path detection information collected by the attacker contains a total of p t detection paths, where p c Paths passing through key node v c Node v c The flow-based betweenness centrality of can be calculated as FBC(v c )=p c / p t .use Indicates that the subpath [nn i ,v c ,nn j ], where In addition, in the false topology, there are The detection path contains subpaths [nn i ,vn i ,vn j ,nn j ]. Therefore, for any virtual node have Obviously, there are Therefore, there is FBC (vn i )≤p c / p t =FBC(v c ), Theorem 3 is proved.

[0073] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0074] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A P4-based anti-Traceroute network topology obfuscation system, characterized by: The system includes a node selector, a topology forger, a configuration generator, and an obfuscation node; The node selector is used to identify key nodes in the target network using a plurality of pre-set evaluation indicators and calculate a node upgrade strategy for obfuscated nodes while satisfying cost constraints; The topology forger is used to construct a fake topology with balanced criticality distribution according to the target network topology and the node upgrade strategy of the obfuscated node; The configuration generator is used to convert the false topology into configuration information of the data packet processing logic of the obfuscation node using the P4 program and send it to the obfuscation node to deploy the false topology on the data plane; The obfuscation node is used to execute customized topology obfuscation data packet processing logic on the data plane to present false topology information to malicious detection data packets and respond to normal detection data packets with real topology information; The node upgrade strategy for calculating the obfuscated node while satisfying the cost constraint includes: Use G = (V, E) to represent the target network topology, where V is the set of nodes in the target network, E is the set of links in the target network, V is the update budget of the network manager, and c is the update budget of the network manager. i Indicates that the node v i ∈V is the upgrade cost required to upgrade to a confusing node, represented by a binary variable x i Represents node v i ∈V is selected to be upgraded to a confusion node if x i =1 means node v i Selected to upgrade to obfuscation node ∑x i c i ≤V For each node v i ∈V, using multiple evaluation indicators to comprehensively evaluate the critical score CS(v i )for Among them, α, β, and γ are weight coefficients that can be adjusted by the network administrator, and α+β+γ=1; The optimization objective is to maximize the sum of the criticality scores of the obfuscated nodes, and the node upgrade problem is modeled as an integer linear programming model: The integer linear programming model is solved using the greedy node selection algorithm to calculate each node v i ∈V value density τ i Afterwards, each node is traversed in descending order of value density, and nodes are upgraded to obfuscated nodes within the upgrade cost constraint.

2. The system according to claim 1, wherein: The target network includes a set of nodes and a set of links; the evaluation indicators include degree centrality, flow-based betweenness centrality, and closeness centrality; the degree centrality is used to describe the connection probability between a node and other nodes in the network, and is defined as where degree(v) represents the degree of node v; the flow-based betweenness centrality is an important indicator for identifying potential key nodes and is defined as Where F represents the set of probe traffic, tvs(f,x) is a binary variable. If it is equal to 1, it means that the routing path of the probe flow f passes through the node v. When identifying key nodes, all possible end-to-end paths with the ingress / egress router as the source address and destination address are considered as potential probe paths for the attacker, that is, |F| = n e (n e -1), where n e is the number of ingress / egress routers in the target network; the closeness centrality is where d v,u Represents the distance between nodes v and u.

3. The system according to claim 1, wherein: The topology forger is used to construct a fake topology with balanced criticality distribution based on the target network topology and the node upgrade strategy of the obfuscated node, including: Each obfuscated node in the target network is split into multiple interconnected virtual nodes through the node splitting method, and the criticality of the obfuscated node is evenly distributed to each virtual node.

4. The system according to any one of claims 1 to 3, characterized in that: Converting the false topology into the configuration information of the packet processing logic of the obfuscation node and delivering it to the obfuscation node to deploy the false topology before the data plane, further comprising: The obfuscation node will save the detection node whitelist, which contains the information of the measurement nodes controlled by the network administrator. The detection node whitelist will match the source IP address field in the data packet header as a keyword. If the data packet is sent by a node in the detection node whitelist, it will be considered a normal detection data packet and forwarded according to the normal data packet processing logic; otherwise, all data packets that are not matched by the detection node whitelist will be considered as potential malicious detection data packets and the TTL dynamic camouflage strategy or ICMP error response will be executed according to the TTL value.

5. The system according to claim 4, characterized in that The configuration generator is used to convert the false topology into configuration information of the data packet processing logic of the obfuscation node using the P4 program and send it to the obfuscation node to deploy the false topology on the data plane, including: The data plane packet processing logic was developed using the P4 program. The detection node whitelist and ICMP error responses were encoded into two "match-action" tables. Each "match-action" table consists of a "key" and "actions." The "key" reveals which fields in the packet are matched, while "actions" represents a collection of actions. The entries in the "match-action" table indicate how to process the packet. That is, when the "key" field in the packet header matches a table entry, the packet is processed according to the action corresponding to the table entry; otherwise, the packet is processed according to the default action. The false topology is converted into a specific "match-action" table entry and sent to the corresponding obfuscation node to implement the false topology deployment.

6. The system according to claim 5, characterized in that The obfuscation node is used to execute customized topology obfuscation packet processing logic on the data plane, presenting false topology information to malicious detection packets and responding to normal detection packets with real topology information, including: When a data packet arrives, the obfuscation node first distinguishes between normal probe packets and potential malicious probe packets by retrieving the probe node whitelist, responding with correct ICMP timeout messages for normal probe packets and fabricating and sending false ICMP timeout messages for potential malicious probe packets, and responding with false ICMP timeout messages for potential malicious probe packets with different TTL values ​​or executing TTL dynamic masquerade strategy.

7. The system according to claim 6, characterized in that The TTL dynamic camouflage strategy means processing the TTL field of the data packet header according to the length of the false path rather than the length of the real path. For the detection data packet that expires on the virtual node split by the obfuscation node, the obfuscation node will dynamically fill the TTL value for the ICMP timeout message so that the message is continuous when it reaches the detection node.

8. The system according to claim 4, wherein: The ICMP error response indicates discarding the data packet that triggers the obfuscation node to execute the ICMP error response and sending an ICMP timeout message containing the IP address of the virtual node and a false TTL value to the source end of the malicious detection data packet.

Images