Network attack detection method and system capable of preventing tool scanning and packet capture debugging

Abstract

The invention discloses a network attack detection method and system capable of preventing tool scanning and package capture debugging, and the method comprises the following steps: S1, injecting a JavaScript control code into a webpage on a server through a gateway, the JavaScript control code being used for generating a Token and injecting the Token into a request header of a client request; s2, after the gateway receives the client request, checking a request header of the client request, and if the request header does not contain the Token or the contained Token is invalid, judging that the client request is illegal; otherwise, judging that the client request is legal. The method aims to prevent attack behaviors such as tool scanning and packet capture debugging, timely monitor and discover malicious behaviors so as to improve the capability of sensing and blocking penetration test events of manual packet capture debugging, and has the advantages of being good in flexibility and convenient to upgrade.

Description

Technical Field

[0001] The present invention relates to network attack detection technology in the field of network security, and in particular to a network attack detection method and system capable of preventing tool scanning and packet capture debugging. Background Art

[0002] The main attack methods used by current network attackers are to frequently scan the network using automated scanning tools and to capture, analyze, modify, and replay application packets using packet capture tools. The existing detection methods for prevention tool scanning and packet capture debugging are based on blacklist detection methods. However, the traditional blacklist-based defense system relies on the update of the rule base. Once the rule base is not updated in time or the attacker uses a 0day attack, it is difficult for enterprises to effectively prevent it. Summary of the invention

[0003] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a network attack detection method and system that can prevent tool scanning and packet capture and debugging are provided. The present invention aims to prevent attack behaviors such as tool scanning and packet capture and debugging, and timely monitor and discover to block malicious behaviors, so as to enhance the ability to perceive and block penetration test events of manual packet capture and debugging, and has the advantages of good flexibility and easy upgrade.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: A network attack detection method capable of preventing tool scanning and packet capture debugging comprises the following steps: S1, injecting JavaScript control code into the web page on the server through the gateway, wherein the JavaScript control code is used to generate a token Token and inject it into the request header of the client request; S2, after receiving the client request, the gateway checks the request header of the client request. If the request header does not contain the token Token or the token Token contained is invalid, the client request is deemed illegal and discarded; otherwise, the client request is deemed legal and forwarded to the server.

[0005] Optionally, injecting JavaScript control code into the web page on the server through the gateway in step S1 includes: setting up an Nginx reverse proxy application gateway for the server's web server on the gateway, specifying the URL that needs to execute reverse proxy for the server's web server in the configuration file of the Nginx reverse proxy application gateway, and calling the specified JavaScript control code by replacing the header element header of the web page on the server.

[0006] Optionally, replacing the header element of the web page on the server side refers to replacing the first header element of the web page on the server side, and exiting immediately after replacing the first header element of the web page on the server side.

[0007] Optionally, it also includes setting the transparent client IP and disabling compression in the configuration file of the Nginx reverse proxy application gateway.

[0008] Optionally, generating the token Token includes generating the token Token using a preset reversible encryption algorithm according to a timestamp requested by the client, a random number and a unified identifier of the client.

[0009] Optionally, the determination that the included token Token is invalid includes: decrypting a timestamp requested by the client from the token Token, and if a time difference between a timestamp requested by the client and a current timestamp of the server exceeds a preset threshold, determining that the included token Token is invalid.

[0010] Optionally, step S2 also includes: logging the result of checking the request header of the client request, and if the number of times the client request is determined to be illegal within a preset time window exceeds a preset threshold, the client's IP address, MAC address or user account is blocked through the network management system.

[0011] In addition, the present invention also provides a network attack detection system that can prevent tool scanning and packet capture debugging, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the network attack detection method that can prevent tool scanning and packet capture debugging.

[0012] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the network attack detection method that can prevent tool scanning and packet capture debugging through a processor.

[0013] In addition, the present invention also provides a computer program product, including a computer program or instruction, which is programmed or configured to execute the network attack detection method that can prevent tool scanning and packet capture debugging through a processor.

[0014] Compared with the prior art, the present invention mainly has the following advantages: 1. The present invention injects JavaScript control code into a web page on a server through a gateway, and the JavaScript control code is used to generate a token Token and inject it into a request header of a client request; after receiving the client request, the gateway checks the request header of the client request, and if the request header does not contain the token Token or the contained token Token is invalid, the client request is determined to be illegal; otherwise, the client request is determined to be legal, thereby preventing attack behaviors such as tool scanning and packet capture and debugging, timely monitoring and discovery to block malicious behaviors, and improving the ability to perceive and block penetration test events of manual packet capture and debugging.

[0015] 2. The present invention injects JavaScript control code into the web page on the server side through the gateway, uses the JavaScript control code injected by the gateway to generate a token Token and injects it into the request header of the client request. It does not require any program changes to the client, and can conveniently and flexibly adjust or modify the way in which the JavaScript control code generates a token Token, thereby facilitating improvement and upgrading, and has the advantages of good flexibility and convenient upgrading. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Schematic diagram of the basic flow of the method of the embodiment of the present invention.

[0017] Figure 2 Schematic diagram of the principle of the method of the embodiment of the present invention. DETAILED DESCRIPTION

[0018] like Figure 1 As shown, the network attack detection method for preventing tool scanning and packet capture debugging in this embodiment includes the following steps: S1, inject JavaScript control code into the web page on the server through the gateway. The JavaScript control code is used to generate a token Token and inject it into the request header of the client request. At this time, if it is a normal client request, the browser will execute the JavaScript control code to carry the correct token Token, thereby generating a client request with a token Token (such as Figure 2 As shown in the figure, in contrast, automated tools for tool scanning and packet capture debugging generally do not use an execution environment (browser) that supports JavaScript, but directly construct requests through scripts. Therefore, there is no relevant token in the request, or the invalid token is only retained mechanically. S2, after receiving the client request, the gateway checks the request header of the client request. If the request header does not contain the token Token or the token Token contained is invalid, the client request is deemed illegal and discarded; otherwise, the client request is deemed legal and forwarded to the server.

[0019] As an optional implementation, injecting JavaScript control code into the web page on the server side through the gateway in step S1 includes: setting up an Nginx reverse proxy application gateway for the web server on the server side on the gateway, specifying the URL that needs to execute reverse proxy for the web server on the server side in the configuration file of the Nginx reverse proxy application gateway, and calling the specified JavaScript control code by replacing the header element of the web page on the server side. Through the flexibility and high performance of the Nginx reverse proxy application gateway, the JavaScript control code can be seamlessly injected into the web page, laying the foundation for subsequent verification and monitoring.

[0020] In this embodiment, replacing the header element of the web page on the server side means replacing the first header element of the web page on the server side, and exiting immediately after replacing the first header element of the web page on the server side. The following is an example of a configuration file for implementing JavaScript control code injection in the Nginx reverse proxy application gateway in this embodiment, where the code behavior in bold font is the key point to implement the injection.

[0021] server { listen80; listen[::]:80; server_name xx.xx; location / { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Accept-Encoding ''; sub_filter '' ' <script charset="utf-8" src=" / / xx.js">< / script> '; sub_filter_once on; proxy_pass https / / xxx.com; } } In the above configuration code, server represents the service configuration block, listen represents the listening port, including port 80 of IPv4 and IPv6, server_name represents the server name, location / represents the location block matches all requests, proxy_set_header X-Forwarded-For represents adding the client's IP address in the proxy server ($proxy_add_x_forwarded_for), proxy_set_header X-Real-IP represents adding the client's original request IP address in the proxy server ($remote_addr), proxy_set_header Accept-Encoding '' represents disabling compression, the line where sub_filter is located represents the injection path of JavaScript control code " / / xx.js", sub_filter_onceon represents replacing the first one matched, and ignoring the others; proxy_pass https / / xxx.com represents #This is the website to be proxied (https / / xxx.com).

[0022] Referring to the above configuration file, this embodiment also includes setting the transparent transmission client IP and disabling compression in the configuration file of the Nginx reverse proxy application gateway.

[0023] Automated tools generally do not use an execution environment (browser) that supports JavaScript, but directly construct requests through scripts, so there is no relevant security token in the request, or only mechanically retains the invalid security token. In view of the above characteristics, by verifying whether there is a token in the request and the validity of the token value on the gateway side, automated tool scanning can be effectively identified and prevented. In this embodiment, JavaScript control code is used to generate a secure random token based on information such as timestamp, random number returned by the server, and unified identification of the terminal for each request, and the generated token is injected into the request header of each request to ensure that each request carries legal token information. The server determines the legitimacy of the request by verifying whether there is a token in the request header and the validity of the token. In this embodiment, generating a token includes generating a token using a preset reversible encryption algorithm according to the timestamp, random number, and unified identification of the client request. It should be noted that the reversible encryption algorithm can use the required reversible encryption algorithm as needed, such as BASE64 and other well-known reversible encryption algorithms or other private reversible encryption algorithms, and this embodiment does not make special reliance or limitation on it.

[0024] In this embodiment, the determination of whether the included token Token is invalid includes: decrypting the timestamp requested by the client from the token Token. If the time difference between the timestamp requested by the client and the current timestamp of the server exceeds a preset threshold, the included token Token is determined to be invalid. The security token Token contains the timestamp when the browser sends the request. When the gateway receives the service request, the time difference between the time when the browser sends the request and the time when the gateway receives the request packet is calculated. If it is greater than a certain range, it is determined that the request may be a replay attack such as packet capture, debugging, and packet modification. During the implementation process, we found that if the timestamp of absolute time is used as the verification object, once the time on the terminal is not synchronized with the time of the gateway, a false alarm will occur. Based on this, this embodiment uses the relative time between the server and the client as the calculation standard of the time window, thereby reducing the judgment error. In addition, it also includes a judgment on the random number. If the random number this time is the same as the random number recorded in the past client request, the included token Token is determined to be invalid.

[0025] In addition, step S2 of this embodiment also includes: logging the results of checking the request header of the client request. If the number of times the client request is determined to be illegal within a preset time window exceeds a preset threshold, the IP address, MAC address or user account of the client is blocked through the network management system. For example, when multiple attacks are detected within one minute, false alarms can be basically ruled out, and the relevant IP addresses or user accounts are blocked through the internal security operation platform to protect the security of the system. In addition, the gateway side can also log all requests and verification results in detail. Once a security incident occurs, the gateway can conduct a comprehensive traceability and analysis of the abnormal request and attack process. The gateway side can also design corresponding response mechanisms according to different types of abnormal requests, including rejecting requests, triggering alarms, sending notifications, and taking other or other appropriate countermeasures.

[0026] The method of this embodiment can improve the ability to perceive and block penetration test events of manual packet capture and debugging. A business security gateway that uses the network attack detection method of this embodiment that can prevent tool scanning and packet capture and debugging is deployed at a certain Internet exit, and the technology of adding timestamps and random numbers is used in the gateway to identify scanning and debugging behaviors. Since the deployment of the application, an average of more than 300 automated tool scanning requests can be monitored every day, and more than 10 penetration test events of manual packet capture and debugging can be perceived and blocked. After testing, compared with the alarm logs of traditional security protection equipment, the network attack detection method of this embodiment that can prevent tool scanning and packet capture and debugging has a 42% detection rate for manual penetration testing.

[0027] In summary, the network attack detection method of this embodiment that can prevent tool scanning and packet capture debugging proposes a new defense method based on the traditional blacklist-based defense system. The gateway injects JavaScript control code into the web page on the server side, and the JavaScript control code is used to generate a token Token and inject it into the request header of the client request; after receiving the client request, the gateway checks the request header of the client request. If the request header does not contain the token Token or the token Token contained is invalid, the client request is determined to be illegal; otherwise, the client request is determined to be legal. The above method implements a mutual verification mechanism between the front end and the back end, and ensures the legitimacy of the request by verifying the token Token generated by the timestamp and random number. At the same time, the time window verification technology is used to accurately monitor the attacker's packet capture debugging behavior, which can effectively prevent tool scanning and packet capture debugging and other attack behaviors, and timely monitor, discover and effectively block malicious behaviors. The method of this embodiment discovered and solved the following several detailed problems: A. The problem of insufficient support for APP clients-the method of this embodiment is to load the relevant security mechanism in the web page through JavaScript. For APP clients using Native development methods, this method is not adaptable enough. In the method of this embodiment, support for JavaScript timestamps is added to some APP page interfaces that are rendered and communicated based on the browser kernel. B. Regarding the problem of insufficient obfuscation and protection of JavaScript scripts - the security mechanism of the method of this embodiment is mainly implemented through JavaScript scripts implanted in the client. However, the client environment is complex and easy to be discovered by attackers and bypassed in a targeted manner. To this end, the method of this embodiment draws on the client code obfuscation protection technology in the R&D process, and obfuscates and protects the JavaScript code of the timestamp control, thereby increasing the difficulty of confrontation for attackers. The method of this embodiment implements JavaScript control injection through the Nignx configuration file, prevents automated tool scanning by verifying the token TOKEN, and discovers packet capture, debugging, and packet modification through timestamp verification.

[0028] In addition, this embodiment also provides a network attack detection system that can prevent tool scanning and packet capture debugging, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the network attack detection method that can prevent tool scanning and packet capture debugging.

[0029] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the network attack detection method that can prevent tool scanning and packet capture debugging through a processor.

[0030] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the network attack detection method that can prevent tool scanning and packet capture debugging through a processor.

[0031] Those skilled in the art should understand that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0032] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A network attack detection method capable of preventing tool scanning and packet capture debugging, characterized in that: The steps include: S1, injecting JavaScript control code into the web page on the server through the gateway, wherein the JavaScript control code is used to generate a token Token and inject it into the request header of the client request; S2: After receiving the client request, the gateway checks the request header of the client request. If the request header does not contain the token or the token contained is invalid, the client request is deemed to be illegal and discarded. Otherwise, the client request is deemed legitimate and forwarded to the server.

2. The network attack detection method capable of preventing tool scanning and packet capture debugging according to claim 1 is characterized in that: In step S1, injecting JavaScript control code into the web page on the server through the gateway includes: setting up an Nginx reverse proxy application gateway for the web server on the server on the gateway, specifying the URL that needs to execute reverse proxy for the web server on the server in the configuration file of the Nginx reverse proxy application gateway, and calling the specified JavaScript control code by replacing the header element header of the web page on the server.

3. The network attack detection method capable of preventing tool scanning and packet capture debugging according to claim 2 is characterized in that: Replacing the header element of the web page on the server side refers to replacing the first header element of the web page on the server side, and exiting immediately after replacing the first header element of the web page on the server side.

4. The network attack detection method capable of preventing tool scanning and packet capture debugging according to claim 2 is characterized in that: It also includes setting up transparent client IP and disabling compression in the configuration file of the Nginx reverse proxy application gateway.

5. The network attack detection method capable of preventing tool scanning and packet capture debugging according to claim 1 is characterized in that: The generating of the token Token includes generating the token Token by using a preset reversible encryption algorithm according to the timestamp requested by the client, a random number and a unified identification of the client.

6. The network attack detection method capable of preventing tool scanning and packet capture debugging according to claim 5 is characterized in that: The determination that the included token Token is invalid includes: decrypting the timestamp requested by the client from the token Token, and if the time difference between the timestamp requested by the client and the current timestamp of the server exceeds a preset threshold, determining that the included token Token is invalid.

7. The network attack detection method capable of preventing tool scanning and packet capture debugging according to claim 1 is characterized in that: Step S2 also includes: logging the result of checking the request header of the client request. If the number of times the client request is determined to be illegal exceeds a preset threshold within a preset time window, the IP address, MAC address or user account of the client is blocked through the network management system.

8. A network attack detection system capable of preventing tool scanning and packet capture debugging, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the network attack detection method capable of preventing tool scanning and packet capture debugging as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the network attack detection method capable of preventing tool scanning and packet capture debugging as described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the network attack detection method capable of preventing tool scanning and packet capture debugging as described in any one of claims 1 to 7 through a processor.

Images