Botnet attack detection method and device

Abstract

The embodiment of the invention aims to provide a botnet attack detection method and device, and the method comprises the steps: taking out a data packet from a cache queue, and obtaining quoted botnet template information according to a security policy id matched with the data packet; and according to the template information, carrying out abnormal flow detection and Trojan horse remote control detection on the quintuple of the data packet and the application layer load information, and when a malicious source related to the botnet is detected, giving an alarm and blocking connection. The botnet attack detection efficiency can be improved, and the security of the host and the server can be effectively protected.

Description

Technical Field

[0001] The present invention belongs to the technical field of network attack detection, and in particular relates to a method for detecting zombie network attacks in a firewall and a device applying the detection method. Background Art

[0002] The main threats to network security are gradually shifting to targeting specific organizations and users. This new type of attack directly threatens the security of corporate organizations and government networks and affects the normal lives of network users. For example, spyware snoops on user sensitive information, spam floods mailbox accounts, and phishing websites steal authentication data. The core of these attacks is the existence of a large number of computers and devices controlled by the attack source. These machines may be homes, schools, companies, or governments in different countries and regions. Attackers use these controlled hosts as anonymous proxies to hide their true identities and intentions, while also amplifying their attack capabilities.

[0003] Zombie malware allows operators to remotely control controlled hosts and organize these hosts into botnets. Due to the highly convertible nature of controlled hosts, that is, from controlled hosts to normal hosts, botnet attacks are difficult to detect and evaluate. Summary of the invention

[0004] In view of the above technical background, the embodiments of the present invention are intended to provide a method and device for detecting botnet attacks, so as to protect intranet servers and user PCs.

[0005] In a first aspect, a method for detecting a botnet attack is provided, comprising: Take the data packet from the cache queue, and obtain the referenced botnet template information according to the security policy ID matched by the data packet; According to the template information, abnormal flow detection and Trojan remote control detection are performed on the five-tuple of the data packet and the application layer load information. When a malicious source related to the botnet is detected, an alarm is issued and the connection is blocked.

[0006] Preferably, the above abnormal traffic detection includes port abnormality detection: No longer judge whether the connection is established or whether the data packet is empty. These conditions are controlled by KNI. Packets that do not meet the conditions will no longer be added to the detection engine queue, reducing redundant steps. Determine whether the destination port and protocol of the data packet meet the first preset condition, record the abnormal quintuple in the hash table, mark the connection of the normal quintuple as normal, and no longer detect the connection subsequently; finally, determine whether the number of abnormalities of the abnormal quintuple in the hash table exceeds 5 times, alarm the connection with more than 5 abnormalities as abnormal traffic, and no longer detect the connection detected as abnormal subsequently; the size of the hash table is set as a macro so that an appropriate value can be configured according to the actual environment later.

[0007] Furthermore, the above abnormal traffic detection also includes protocol anomaly detection and outgoing traffic anomaly detection.

[0008] Protocol anomaly detection specifically includes: KNI no longer uploads data packets with no connection established, data packets with empty payload, and data packets that have been detected as abnormal traffic to the detection engine; then it performs protocol detection and destination port judgment on the data packets, and records the five-tuple whose protocol and destination port do not meet the second preset condition as an abnormal connection. An alarm log will be generated for more than 5 abnormal connections.

[0009] Outbound traffic anomaly detection specifically includes: hashing the source IP, storing the statistical value and timestamp information of the data packet in the hash table, and judging whether the number of data packets sent by the source IP within the statistical period exceeds the preset threshold to determine whether the outbound traffic is abnormal, and issuing an alarm for abnormal traffic.

[0010] Preferably, when performing abnormal traffic detection on data packets as mentioned above, it is necessary to perform detection according to a variety of different detection rules, and to make reasonable judgments on the user-configured detection switches. Data packets with abnormal traffic are detected to send alarm logs, and the connection label is marked with an abnormal mark. Subsequent connections will no longer be detected, reducing the impact on performance.

[0011] Preferably, the above Trojan remote control detection includes: performing regular matching on data packets according to regular expression handles compiled by rules; when encoding, HyperScan can be considered for regular matching. HyperScan, as a high-performance regular processing solution provided by Intel, can be combined with DPDK to further improve detection performance.

[0012] In a second aspect, a botnet attack detection device is provided, comprising: Initialization module: After the system starts, the user configuration information is read into the memory and the signal processing function is registered to provide strategy information for subsequent detection tasks; and when the configuration change signal sent by the front end is received, the user configuration is re-read; The abnormal traffic detection module detects according to different rules, sends an alarm when abnormal traffic is found, and marks the connection as abnormal, and subsequent connections will no longer be detected; The Trojan remote control detection module performs regular matching on data packets based on the regular expression handle compiled by the rules.

[0013] The initialization module, If it is the first initialization after the system is started: read the policy information from the database and store it in an array; load the Trojan rules from the Trojan rule library into the memory; register the initialization signal processing function; If it is not the first initialization: lock, wait for all tasks in the task queue to be executed, and block new tasks from entering the task queue; clear the security policy information and botnet policy information in the global variables; read the policy information from the database and store it in an array; release the lock to allow the task thread to continue to be scheduled; register the initialization signal processing function.

[0014] The above abnormal traffic detection module includes port abnormality detection, protocol abnormality detection and outgoing traffic abnormality detection.

[0015] The embodiment of the present invention adopting the above technical content has at least the following beneficial effects: taking out a data packet from the cache queue, obtaining the referenced botnet template information according to the security policy ID matched by the data packet; performing abnormal flow detection and Trojan remote control detection on the five-tuple and application layer load information of the data packet according to the template information, and issuing an alarm and blocking the connection when a malicious source related to the botnet is detected. It can improve the efficiency of botnet attack detection and effectively protect the security of the host and server. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of the overall workflow of an embodiment of the botnet attack detection method of the present invention; Figure 2 This is a schematic diagram of the module composition of an embodiment of a botnet attack detection device of the present invention. Implementation

[0017] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant contents of the present application, rather than to limit the application. It should also be noted that, for ease of description, only the parts related to the application are shown in the accompanying drawings.

[0018] like Figure 1 As shown, a method for detecting a botnet attack includes the following main steps: Initialize the dpdk environment and ring cache queue; read the configuration file from the database and register the signal processing function.

[0019] Take out the data packet from the cache queue and determine whether the data packet is read. If it is read, proceed to the next step, otherwise sleep and wait.

[0020] The referenced botnet template ID is searched according to the security policy ID carried in the data packet, and the template information is read; based on the template information, abnormal traffic detection and Trojan remote control detection are performed on the five-tuple and application layer load information of the data packet, and an alarm is issued and the connection is blocked when a malicious source related to the botnet is detected.

[0021] After the detection is completed, the clone package is released.

[0022] As a preferred implementation, the above abnormal traffic detection includes port abnormality detection.

[0023] Specifically, it no longer determines whether a connection is established or whether a data packet is empty. These conditions are controlled by KNI, and packets that do not meet the conditions will no longer be added to the detection engine queue, reducing redundant steps. Determine whether the destination port and protocol of the data packet meet the first preset condition, record the abnormal quintuple in the hash table, mark the connection of the normal quintuple as normal, and no longer detect the connection subsequently; finally, determine whether the number of abnormalities of the abnormal quintuple in the hash table exceeds 5 times, alarm the connection with more than 5 abnormalities as abnormal traffic, and no longer detect the connection detected as abnormal subsequently; the size of the hash table is set as a macro so that an appropriate value can be configured according to the actual environment later.

[0024] As a preferred implementation, the above abnormal traffic detection includes protocol anomaly detection.

[0025] Specifically, KNI no longer uploads data packets with unestablished connections, data packets with empty payloads, and data packets that have been detected as abnormal traffic to the detection engine; it then performs protocol detection and destination port judgment on the data packets, and records the five-tuple whose protocol and destination port do not meet the second preset condition as an abnormal connection. If there are more than five abnormal connections, an alarm log will be generated.

[0026] As a preferred implementation, the above abnormal traffic detection also includes outbound traffic abnormality detection.

[0027] Specifically, the source IP is hashed, and the statistical value and timestamp information of the data packet are stored in the hash table. By judging whether the number of data packets sent by the source IP within the statistical period exceeds the preset threshold, it is determined whether the outbound traffic is abnormal, and an alarm is issued for the abnormal traffic.

[0028] As a preferred implementation method, when detecting abnormal traffic on data packets, it is necessary to perform detection according to a variety of different detection rules, and to make reasonable judgments on the user-configured detection switches. Data packets with abnormal traffic will send alarm logs and the connection label will be marked as abnormal. Subsequent connections will no longer be detected to reduce the impact on performance.

[0029] As a preferred implementation, the above-mentioned Trojan remote control detection specifically includes: performing regular matching on data packets according to regular expression handles compiled by rules; when encoding, HyperScan can be considered for regular matching. HyperScan, as a high-performance regular processing solution provided by Intel, can be combined with DPDK to further improve detection performance.

[0030] like Figure 2 As shown, a botnet attack detection device comprises: Initialization module: After the system starts, the user configuration information is read into the memory and the signal processing function is registered to provide strategy information for subsequent detection tasks; and when the configuration change signal sent by the front end is received, the user configuration is re-read; The abnormal traffic detection module detects according to different rules, sends an alarm when abnormal traffic is found, and marks the connection as abnormal, and subsequent connections will no longer be detected; The Trojan remote control detection module performs regular matching on data packets based on the regular expression handle compiled by the rules.

[0031] The initialization module, If it is the first initialization after the system is started: read the policy information from the database and store it in an array; load the Trojan rules from the Trojan rule library into the memory; register the initialization signal processing function; If it is not the first initialization: lock, wait for all tasks in the task queue to be executed, and block new tasks from entering the task queue; clear the security policy information and botnet policy information in the global variables; read the policy information from the database and store it in an array; release the lock to allow the task thread to continue to be scheduled; register the initialization signal processing function.

[0032] The abnormal traffic detection module includes port abnormality detection, protocol abnormality detection and outgoing traffic abnormality detection.

[0033] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0034] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. A method for detecting a botnet attack, characterized in that: include: Take the data packet from the cache queue, and obtain the referenced botnet template information according to the security policy ID matched by the data packet; According to the template information, abnormal flow detection and Trojan remote control detection are performed on the five-tuple of the data packet and the application layer load information. When a malicious source related to the botnet is detected, an alarm is issued and the connection is blocked.

2. The attack detection method according to claim 1, characterized in that: The abnormal traffic detection includes port abnormality detection: No longer judge whether the connection is established or whether the data packet is empty. These conditions are controlled by KNI. Packets that do not meet the conditions will no longer be added to the detection engine queue, reducing redundant steps. Determine whether the destination port and protocol of the data packet meet the first preset condition, record the abnormal quintuple in the hash table, mark the connection of the normal quintuple as normal, and no longer detect the connection subsequently; finally, determine whether the number of abnormalities of the abnormal quintuple in the hash table exceeds 5 times, alarm the connection with more than 5 abnormalities as abnormal traffic, and no longer detect the connection detected as abnormal subsequently; the size of the hash table is set as a macro so that an appropriate value can be configured according to the actual environment later.

3. The attack detection method according to claim 1, characterized in that: The abnormal traffic detection includes protocol anomaly detection: KNI no longer uploads data packets with unestablished connections, data packets with empty payloads, and data packets that have been detected as abnormal traffic to the detection engine; it then performs protocol detection and destination port judgment on the data packets, and records the five-tuple whose protocol and destination port do not meet the second preset condition as an abnormal connection. If there are more than 5 abnormal connections, an alarm log will be generated.

4. The attack detection method according to claim 1, characterized in that: The abnormal traffic detection includes outgoing traffic abnormality detection: Hash the source IP, store the statistical value and timestamp information of the data packet in the hash table, and determine whether the outbound traffic is abnormal by judging whether the number of data packets sent by the source IP within the statistical period exceeds the preset threshold, and issue an alarm for abnormal traffic.

5. The attack detection method according to any one of claims 1 to 4, characterized in that: When detecting abnormal traffic on data packets, it is necessary to detect them according to a variety of different detection rules and make reasonable judgments on the user-configured detection switches. Data packets with abnormal traffic will be sent alarm logs and the connection label will be marked as abnormal. Subsequent connections will no longer be detected to reduce the impact on performance.

6. The attack detection method according to claim 1, characterized in that: The Trojan remote control detection: Perform regular matching on data packets according to the regular expression handle compiled by the rules; when encoding, consider using HyperScan for regular matching. HyperScan is a high-performance regular expression processing solution provided by Intel, which can be combined with DPDK to further improve detection performance.

7. A botnet attack detection device, characterized in that: The device includes: Initialization module: After the system starts, the user configuration information is read into the memory and the signal processing function is registered to provide strategy information for subsequent detection tasks; and when the configuration change signal sent by the front end is received, the user configuration is re-read; The abnormal traffic detection module detects according to different rules, sends an alarm when abnormal traffic is found, and marks the connection as abnormal, and subsequent connections will no longer be detected; The Trojan remote control detection module performs regular matching on data packets based on the regular expression handle compiled by the rules.

8. The detection device according to claim 7, characterized in that: The initialization module, If it is the first initialization after the system is started: read the policy information from the database and store it in an array; load the Trojan rules from the Trojan rule library into the memory; register the initialization signal processing function; If it is not the first initialization: lock, wait for all tasks in the task queue to be executed, and block new tasks from entering the task queue; Clear the security policy information and botnet policy information in the global variables; read the policy information from the database and store it in an array; release the lock to allow the task thread to continue to be scheduled; register the initialization signal processing function.

9. The detection device according to claim 7, characterized in that: The abnormal traffic detection module includes port abnormality detection, protocol abnormality detection and outgoing traffic abnormality detection.

Images