Malicious domain name monitoring method based on P4 programmable switch

Abstract

The invention relates to the field of network security, and discloses a malicious domain name monitoring method based on a P4 programmable switch, which comprises the following steps of: firstly, configuring a traffic mirroring function in corresponding network equipment, and mirroring traffic needing to be monitored to an external port of the P4 programmable switch; the P4 programmable switch component collects a data packet containing domain name information from all traffic received from the external port and forwards the data packet to a backboard port of the server component, and domain name traffic collection is completed; the server component monitors a backboard port interconnected with the P4 programmable switch component and extracts related information of a data packet which is forwarded by the P4 programmable switch component and contains domain name information; and taking the domain name as a query condition, querying the malicious domain name information library, and generating a malicious domain name monitoring table. According to the method, the flow containing the domain name is collected from the ultra-large flow through the P4 programmable switch and forwarded to the server, malicious domain name analysis is carried out, meanwhile, the flow is displayed in a web interface, and malicious domain name monitoring is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a malicious domain name monitoring method based on a P4 programmable switch. Background Art

[0002] Malware detection has always been a hot topic in network security. DGA dynamically generates a large number of pseudo-random domain names and mixes the control server domain name into the DGA domain name, so that the malware can use the DNS domain name system to bypass security detection, successfully access the control server, and receive the attacker's instructions to perform malicious operations. Therefore, it is very important to monitor malicious domain names efficiently.

[0003] However, in the Internet society, especially in the 5G era, high-quality network systems have become the foundation for the development of the digital economy. The rapid development of various fields requires faster and lower-cost information networks. The average download rate of my country's broadband network has increased from 4.25Mbps at the end of 2014 to 62.5Mbps at the end of 2021, an increase of nearly 14 times. Therefore, how to collect domain name traffic for analysis and realize malicious domain name monitoring in ultra-large traffic, especially in network scenarios with T-level bandwidth such as backbone networks, metropolitan area networks, 5G core networks, and ultra-large data centers, has become a new challenge and test.

[0004] The traditional method is to monitor and analyze all traffic directly through the server. Due to the performance of the CPU processor, a large-scale cluster is required to cope with large traffic scenarios, but there are disadvantages such as high hardware investment costs and difficulty in software development. For example:

[0005] 1. Ordinary dual-core CPU processor servers are subject to CPU processor and PCIe performance constraints. The traffic processing performance of a single server generally does not exceed 100G. Monitoring of dozens of TB of traffic requires at least hundreds of server hardware, which is costly.

[0006] 2. Ordinary traffic monitoring programs only have a traffic processing performance of tens of megabytes or hundreds of megabytes. If a single server wants to achieve a traffic processing performance of tens of G, it needs to invest a lot of R&D personnel and time to optimize the program and system;

[0007] 3. Large-scale cluster deployment of dozens or hundreds of servers has complex cluster functions and requires a large amount of R&D personnel and time to develop cluster and unified management functions. Summary of the invention

[0008] The purpose of the present invention is to provide a malicious domain name monitoring method based on a P4 programmable switch. Through a single P4 programmable switch with a traffic processing performance of 3.2T to 25.6T, traffic containing domain names is collected from ultra-large traffic and forwarded to a server, malicious domain name analysis is performed, and the malicious domain name is displayed in a web interface to realize malicious domain name monitoring. The technical problems of high hardware investment cost, great difficulty and long cycle of software development of ordinary servers are solved.

[0009] The purpose of the present invention can be achieved through the following technical solutions:

[0010] A malicious domain name monitoring method based on a P4 programmable switch, comprising:

[0011] S1, traffic mirroring: configure the traffic mirroring function in the corresponding network device, and mirror the traffic to be monitored to the external port of the P4 programmable switch;

[0012] The S2 and P4 programmable switch components collect data packets containing domain name information from all traffic received from the external ports and forward them to the backplane ports of the server components, completing the domain name traffic collection;

[0013] S3. The server component monitors the backplane port interconnected with the P4 programmable switch component, extracts the relevant information of the data packet containing domain name information forwarded by the P4 programmable switch component; uses the domain name as the query condition, queries the malicious domain name intelligence database, generates a malicious domain name monitoring table, and completes the malicious domain name analysis.

[0014] As a further technical solution, S2 specifically comprises the following steps:

[0015] S2.1, predefined ethernet, ipv4, ipv6, tcp, http, tls protocol headers;

[0016] S2.2, parsing all data packets in all traffic received from the external port through a parser, and judging whether the data packets are Ethernet frames according to the Ethernet packet header format;

[0017] S2.3, the data packet is an Ethernet frame, determine the value of the Type field in the Ethernet packet header;

[0018] S2.4, the data packet is an IP protocol message, and the IPv4 and IPv6 header field values ​​are determined;

[0019] S2.5, if the data packet is a TCP protocol message, determine whether the data packet is an HTTP or TLS protocol message based on the HTTP or TLS packet header format;

[0020] S2.6, the data packet is an http or tls protocol message, and the validity of the http or tls header field value is judged by matching the action table to determine whether the data packet contains domain name information;

[0021] S2.7, reassemble the data packet through the reverse parser and forward it to the backplane port to complete the domain name traffic collection.

[0022] As a further technical solution, the step of determining the value of the Ethernet packet header Type field in S2.3 is:

[0023] S2.3.1, the Ethernet packet header Type field value is equal to 0x0800, judging that the data packet is an IPv4 protocol message;

[0024] S2.3.2. The Type field value of the Ethernet packet header is equal to 0x86dd, which indicates that the data packet is an IPv6 protocol message.

[0025] As a further technical solution, the step of determining the IPv4 and IPv6 header field values ​​in S2.4 is as follows:

[0026] S2.4.1, the Protocol field value of the IPv4 packet header is equal to 6, which means the data packet is a TCP protocol message;

[0027] S2.4.2. The NextHeader field value of the IPv6 packet header is equal to 6, which indicates that the data packet is a TCP protocol message.

[0028] As a further technical solution, the step of determining whether the data packet is an http or tls protocol message in S2.5 is:

[0029] S2.5.1. The RequestMethod field value in the http packet header is equal to the GET, POST or HEAD request method value, and the data packet is judged to be an http protocol message;

[0030] S2.5.2. The value of the ContentType field in the TLS packet header is equal to 22, which indicates that the data packet is a TLS protocol message.

[0031] As a further technical solution, the step of judging the validity of the http and tls header field values ​​by matching the action table in S2.6 and determining whether the data packet contains domain name information is as follows:

[0032] S2.6.1. The Host field value in the http packet header isValid() is equal to True, and the Host field value is valid. In the action table, modify the metadata egress_port data packet physical egress port value to the backplane port.

[0033] S2.6.2. The ServerName field value in the tls packet header is judged to be True by isValid(), and the ServerName field value is valid. In the action table, the metadata egress_port data packet physical egress port value is modified to the backplane port.

[0034] As a further technical solution, S3 specifically includes the following steps:

[0035] S3.1, the server component takes over the backplane port interconnected with the P4 programmable switch component through the program written by dpdk, and receives all data packets on the backplane port network card;

[0036] S3.2, extract the time, domain name, application protocol, source IP, and source port information in the data packet to generate a domain name information table;

[0037] S3.3. Extract the domain name in the domain name information table as the query condition, query the malicious domain name intelligence database, associate the query result with the domain name information table, generate a malicious domain name monitoring table, and complete the malicious domain name analysis.

[0038] As a further technical solution, the method further includes:

[0039] S4. Export all the data in the malicious domain name monitoring table through the written CGI program, and format the data into HTML format; apply CSS style to make the HTML page visually beautiful, and finally send the HTML page to the Web browser for display.

[0040] Beneficial effects of the present invention:

[0041] (1) The present invention uses a single P4 programmable switch with a traffic processing performance of 3.2T to 25.6T to collect traffic containing domain names from ultra-large traffic and forward it to the server to perform malicious domain name analysis and display it in the web interface, thereby reducing the hardware investment cost and software development difficulty and time of malicious domain name monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The present invention will be further described below in conjunction with the accompanying drawings.

[0043] Figure 1 It is the overall logic block diagram of the present invention;

[0044] Figure 2 is a flow chart of step S2 in the present invention;

[0045] Figure 3 is a flow chart of step S3 in the present invention;

[0046] Figure 4 is a flow chart of step S1 in the present invention;

[0047] Figure 5 This is an example diagram of domain name information table;

[0048] Figure 6 This is an example diagram of malicious domain name monitoring. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] See also Figure 1-Figure 6 As shown, the present invention is a malicious domain name monitoring method based on a P4 programmable switch, comprising:

[0051] S1, traffic mirroring: configure the traffic mirroring function in the corresponding network device, and mirror the traffic to be monitored to the external port of the P4 programmable switch; the network device is a switch or a router;

[0052] The S2 and P4 programmable switch components collect data packets containing domain name information from all traffic received from the external ports and forward them to the backplane ports of the server components, completing the domain name traffic collection;

[0053] S3. The server component monitors the backplane port interconnected with the P4 programmable switch component, extracts the relevant information of the data packet containing domain name information forwarded by the P4 programmable switch component; uses the domain name as the query condition, queries the malicious domain name intelligence database, generates a malicious domain name monitoring table, and completes the malicious domain name analysis.

[0054] The S2 specifically comprises the following steps:

[0055] S2.1, predefined ethernet, ipv4, ipv6, tcp, http, tls protocol headers;

[0056] S2.2, parsing all data packets in all traffic received from the external port by the parser, and judging whether the data packets are Ethernet frames according to the Ethernet packet header format;

[0057] S2.3, the data packet is an Ethernet frame, determine the value of the Type field in the Ethernet packet header;

[0058] S2.4, the data packet is an ip protocol message, i.e. ipv4 or ipv6, and the ipv4 or ipv6 packet header field value is determined;

[0059] S2.5, if the data packet is a TCP protocol message, determine whether the data packet is an HTTP or TLS protocol message based on the HTTP or TLS packet header format;

[0060] S2.6, the data packet is an http or tls protocol message, and the validity of the http or tls header field value is judged by matching the action table match-action table to determine whether the data packet contains domain name information;

[0061] S2.7. The data packet is reassembled through the Deparser and forwarded to the backplane port to complete the domain name traffic collection.

[0062] The steps for determining the value of the Type field in the Ethernet packet header in S2.3 are:

[0063] S2.3.1, the Ethernet packet header Type field value is equal to 0x0800, judging that the data packet is an IPv4 protocol message;

[0064] S2.3.2. The Type field value of the Ethernet packet header is equal to 0x86dd, which indicates that the data packet is an IPv6 protocol message.

[0065] The steps of determining the IPv4 and IPv6 header field values ​​in S2.4 are as follows:

[0066] S2.4.1, the Protocol field value of the IPv4 packet header is equal to 6, which means the data packet is a TCP protocol message;

[0067] S2.4.2. The NextHeader field value of the IPv6 packet header is equal to 6, which indicates that the data packet is a TCP protocol message.

[0068] The step of determining whether the data packet is an http or tls protocol message in S2.5 is:

[0069] S2.5.1. The RequestMethod field value in the http packet header is equal to the GET, POST or HEAD request method value, and the data packet is judged to be an http protocol message;

[0070] S2.5.2. The value of the ContentType field in the TLS packet header is equal to 22, which indicates that the data packet is a TLS protocol message.

[0071] The steps in S2.6 to determine the validity of the http and tls header field values ​​by matching the action table and determining whether the data packet contains domain name information are:

[0072] S2.6.1. The Host field value in the http packet header isValid() is equal to True, and the Host field value is valid. In the action table, modify the metadata egress_port data packet physical egress port value to the backplane port.

[0073] S2.6.2. The ServerName field value in the tls packet header is judged to be True by isValid(), and the ServerName field value is valid. In the action table, the metadata egress_port data packet physical egress port value is modified to the backplane port.

[0074] In this embodiment, a single P4 programmable switch with a traffic processing performance of 3.2T to 25.6T is used to collect traffic containing domain names from ultra-large traffic and forward it to the server for malicious domain name analysis. At the same time, it is displayed in the web interface to achieve malicious domain name monitoring. This solves the technical problems of ordinary servers, such as high hardware investment costs, difficult software development, and long cycles.

[0075] The S3 specifically comprises the following steps:

[0076] S3.1, the server component takes over the backplane port interconnected with the P4 programmable switch component through the program written by dpdk, and receives all data packets on the backplane port network card;

[0077] S3.2, extract the time, domain name, application protocol, source IP, and source port information in the data packet to generate a domain name information table;

[0078] S3.3. Extract the domain name in the domain name information table as the query condition, query the malicious domain name intelligence database, associate the query result with the domain name information table, generate a malicious domain name monitoring table, and complete the malicious domain name analysis.

[0079] Through the above technical solutions, the server components can realize real-time monitoring of network traffic and rapid identification of malicious domain names, thereby effectively improving the security of the network; once a malicious domain name is discovered, corresponding security measures can be taken immediately to prevent the further expansion and spread of security incidents; at the same time, the automated data packet processing, information extraction and malicious domain name monitoring processes reduce the workload of operation and maintenance personnel and improve operation and maintenance efficiency and accuracy; and, through the analysis and feedback of malicious domain name monitoring results, the existing security strategies can be continuously optimized to improve the overall protection level of network security.

[0080] The method further comprises:

[0081] S4. Export all the data in the malicious domain name monitoring table through the written CGI program, and format the data into HTML format; apply CSS style to make the HTML page visually beautiful, and finally send the HTML page to the Web browser for display.

[0082] Through the above technical solution, by automatically exporting and displaying the monitoring data in a web browser, administrators can view the latest malicious domain name list in real time, thereby quickly responding to potential security threats; displaying the data in HTML format allows people with non-technical backgrounds to easily understand the current security status, which helps cross-departmental collaboration and ensures that the entire organization has a clear understanding of the network security status; at the same time, the HTML table format facilitates the classification, sorting and filtering of data, allowing administrators to more easily analyze the trends, sources and characteristics of malicious domain names, thereby formulating more effective defense strategies; and applying CSS styles to beautify HTML pages not only improves the readability and ease of use of the pages, but also enhances the user experience; and, by displaying data through a web browser, administrators can access malicious domain name monitoring information anytime and anywhere, without being limited to a specific physical location or device.

[0083] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A malicious domain name monitoring method based on a P4 programmable switch, characterized in that: include: S1, traffic mirroring: configure the traffic mirroring function in the corresponding network device, and mirror the traffic to be monitored to the external port of the P4 programmable switch; The S2 and P4 programmable switch components collect data packets containing domain name information from all traffic received from the external ports and forward them to the backplane ports of the server components, completing the domain name traffic collection; S3. The server component monitors the backplane port interconnected with the P4 programmable switch component, extracts the relevant information of the data packet containing domain name information forwarded by the P4 programmable switch component; uses the domain name as the query condition, queries the malicious domain name intelligence database, generates a malicious domain name monitoring table, and completes the malicious domain name analysis.

2. The malicious domain name monitoring method based on a P4 programmable switch according to claim 1 is characterized in that: The S2 specifically comprises the following steps: S2.1, predefined ethernet, ipv4, ipv6, tcp, http, tls protocol headers; S2.2, parsing all data packets in all traffic received from the external port through a parser, and judging whether the data packets are Ethernet frames according to the Ethernet packet header format; S2.3, the data packet is an Ethernet frame, determine the value of the Type field in the Ethernet packet header; S2.4, the data packet is an IP protocol message, and the IPv4 and IPv6 packet header field values ​​are determined; S2.5, if the data packet is a TCP protocol message, determine whether the data packet is an HTTP or TLS protocol message based on the HTTP or TLS packet header format; S2.6, the data packet is an http or tls protocol message, and the validity of the http or tls header field value is judged by matching the action table to determine whether the data packet contains domain name information; S2.7, reassemble the data packet through the reverse parser and forward it to the backplane port to complete the domain name traffic collection.

3. The malicious domain name monitoring method based on a P4 programmable switch according to claim 2 is characterized in that: The steps for determining the value of the Type field in the Ethernet packet header in S2.3 are: S2.3.1, the Ethernet packet header Type field value is equal to 0x0800, judging that the data packet is an IPv4 protocol message; S2.3.

2. The Type field value of the Ethernet packet header is equal to 0x86dd, which indicates that the data packet is an IPv6 protocol message.

4. The malicious domain name monitoring method based on a P4 programmable switch according to claim 2 is characterized in that: The steps for determining the IPv4 and IPv6 header field values ​​in S2.4 are as follows: S2.4.1, the Protocol field value of the IPv4 packet header is equal to 6, which means the data packet is a TCP protocol message; S2.4.

2. The NextHeader field value of the i pv6 packet header is equal to 6, which indicates that the data packet is a TCP protocol message.

5. The malicious domain name monitoring method based on a P4 programmable switch according to claim 2 is characterized in that: The step of determining whether the data packet is an http or tls protocol message in S2.5 is: S2.5.

1. The RequestMethod field value in the http packet header is equal to the GET, POST or HEAD request method value, and the data packet is judged to be an http protocol message; S2.5.

2. The value of the ContentType field in the TLS packet header is equal to 22, which indicates that the data packet is a TLS protocol message.

6. The malicious domain name monitoring method based on a P4 programmable switch according to claim 2 is characterized in that: The steps in S2.6 to determine the validity of the http and tls header field values ​​by matching the action table and determining whether the data packet contains domain name information are: S2.6.

1. The Host field value in the http packet header isValid() is equal to True, and the Host field value is valid. In the action table, modify the metadata egress_port data packet physical egress port value to the backplane port. S2.6.

2. The ServerName field value in the tls packet header isValid() is equal to True, and the ServerName field value is valid. In the action table, modify the metadata egress_port data packet physical egress port value to the backplane port.

7. The malicious domain name monitoring method based on a P4 programmable switch according to claim 1 is characterized in that: The S3 specifically comprises the following steps: S3.1, the server component takes over the backplane port interconnected with the P4 programmable switch component through the program written by dpdk, and receives all data packets on the backplane port network card; S3.2, extract the time, domain name, application protocol, source IP, and source port information in the data packet to generate a domain name information table; S3.

3. Extract the domain name in the domain name information table as the query condition, query the malicious domain name intelligence database, associate the query result with the domain name information table, generate a malicious domain name monitoring table, and complete the malicious domain name analysis.

8. The malicious domain name monitoring method based on a P4 programmable switch according to claim 1 is characterized in that: The method further comprises: S4. Export all the data in the malicious domain name monitoring table through the written CGI program, and format the data into HTML format; apply CSS style to make the HTML page visually beautiful, and finally send the HTML page to the Web browser for display.

Images