A detection method, system, and device for defending against network attacks based on the Netfilter framework.

Abstract

This application provides a detection method, system, and apparatus for defending against network attacks based on the Netfilter framework. The detection method is applied to a defense system between a client and a server to be accessed by the client. The method includes: sending access traffic from the client to an authentication tunnel module via a first detection point for authentication; after successful authentication, the defense system initiates a process to establish a secure communication tunnel with the client; sending data packets destined for the application layer to an application firewall module via a second detection point for web attack detection; the second and first detection points are respectively set on the PREROUTING chain of the Netfilter framework; and sending data packets detected by the application firewall module to a packet filtering module via a third detection point for network layer detection; the third detection point is set on the FORWARD chain of the Netfilter framework.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a detection method, system and device for defending against network attacks based on the Netfilter framework. Background Technology

[0002] Currently, the main methods for defending against network attacks include network layer defense, application layer defense, and authentication and the establishment of secure communication tunnels before access. Network layer defense operates at layers 3 and 4 of the Open Systems Interconnection (OSI) model, protecting data transmission and network traffic. Application layer defense operates at layer 7 of the OSI model, defending against attacks targeting cookie manipulation, SQL injection, and URL manipulation. A typical defense approach involves sequentially deploying an authentication system, a traditional firewall, and an application layer firewall in the network environment. After successful authentication, access traffic is inspected by two firewall systems before accessing the subsequent services. Deploying and configuring these three types of devices requires administrators to switch platforms, preventing dynamic adjustments to the rules between devices based on specific attack scenarios. This makes it difficult to establish secure communication tunnels between clients and the three types of devices. Summary of the Invention

[0003] This application provides a detection method, system, and apparatus for defending against network attacks based on the Netfilter framework, which can improve the flexibility of the defense system deployment while achieving multiple detections and effective defense against network attacks.

[0004] In a first aspect, embodiments of this application provide a detection method for defending against network attacks based on the Netfilter framework, applied to a defense system located between a client and a server to be accessed by the client. The method includes:

[0005] The access traffic from the client is sent to the authentication tunnel module through the first detection point for authentication. After successful authentication, the defense system initiates the process of establishing a secure communication tunnel with the client.

[0006] The data packets sent to the application layer are sent to the application firewall module through the second detection point, and Web attack detection is performed; wherein, the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework;

[0007] The data packets detected by the application firewall module are sent to the packet filtering module through the third detection point for network layer detection; wherein, the third detection point is set on the FORWARD chain of the Netfilter framework.

[0008] In one possible implementation, the defense system further includes a log analysis and dynamic policy generation module connected to the authentication tunnel module, the application firewall module, and the packet filtering module, respectively; the method further includes:

[0009] The dynamic policy generation module obtains attack logs from the application firewall module and packet filtering logs from the packet filtering module through the log analysis module.

[0010] The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point;

[0011] The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

[0012] In one possible implementation, the analysis of the attack logs to generate a defense blocking strategy for the first detection point and the third detection point includes one of the following:

[0013] The authentication tunnel module is notified through the first detection point to kick out the user accessing the client and disconnect the secure communication tunnel;

[0014] By generating a packet filtering blocking policy targeting the network layer, the IP address of the accessing user is blocked at the third detection point.

[0015] Attack defense measures are strengthened at both the first and third detection points.

[0016] In one possible implementation, the step of sending access traffic from the client to the authentication tunnel module through the first detection point and performing authentication determination includes:

[0017] After the access traffic from the client hits the first detection point, the access traffic enters the authentication tunnel module;

[0018] The authentication tunnel module authenticates the identity information of the accessing user from the client.

[0019] If authentication fails, login will be denied.

[0020] If authentication is successful, a virtual IP is assigned to the client, and the virtual IP and the IP of the defense system are sent to the client to establish a secure communication tunnel between the client and the defense system.

[0021] In one possible implementation, the application firewall module includes an Nginx-based limit_conn_zone module, limit_request module, core module, and ModSecurity module. The step of sending data packets destined for the application layer to the application firewall module via a second detection point and performing web attack detection includes:

[0022] The data packets sent to the application layer are transmitted through the second detection point to the limit_conn_zone module, the limit_request module, the core module, and the ModSecurity module;

[0023] The limit_conn_zone module limits the number of concurrent connections from the same IP address.

[0024] The limit_request module is used to limit the number of accesses from the same IP address within a specific time period;

[0025] The traffic to the same IP address is limited by the limit_rate provided by the core module;

[0026] If the access traffic is detected to have triggered restrictions on the limit_conn_zone module, the limit_request module, and the core module, an alarm will be triggered and the corresponding logs will be recorded.

[0027] The ModSecurity module analyzes attack details of URLs allowed by Nginx, recording and blocking malicious activities and attacks.

[0028] In one possible implementation, the step of sending the data packets detected by the application firewall module to the packet filtering module via the third detection point and performing network layer detection includes:

[0029] The data packets detected by the application firewall module are sent to the packet filtering module through the third detection point;

[0030] The packet filtering module detects whether there is a network layer DoS attack and filters the five-tuples of data packets detected by the application firewall module.

[0031] In one possible implementation, if both the second detection point and the third detection point are enabled, the method further includes the following step before the application firewall module performs web attack detection:

[0032] If the server accessed by the client through the defense system is configured with an application firewall protection policy, the access traffic hits the second detection point, and the application firewall filters the data packets sent to the application layer to obtain filtered data packets.

[0033] By modifying the kernel code of the hook point in the PREROUTING chain, the packet filtering policy of the third detection point is invoked again to filter the filtered data packets, which are then redirected to the local area of ​​the defense system, so that the application firewall module can detect web attack types.

[0034] In one possible implementation, if the first detection point, the second detection point, and the third detection point are all enabled, before sending the data packet detected by the WAF module through the third detection point to the packet filtering module, the method further includes:

[0035] The data packets detected by the application firewall module are sent to the POSTROUTING chain, where they hit the SNAT translation rule to obtain the translated data packets; wherein, the POSTROUTING chain is located on the Netfilter framework;

[0036] By modifying the kernel code of the hook point in the POSTROUTING chain, the converted data packet is sent to the packet filtering module so that the packet filtering module can perform network layer detection.

[0037] Secondly, embodiments of this application provide a defense system for defending against network attacks based on the Netfilter framework. The defense system is located between a client and a server that the client needs to access. The system includes:

[0038] The first and second detection points are respectively set on the PREROUTING chain, and the third detection point is set on the FORWARD chain; wherein the PREROUTING chain and the FORWARD chain are located on the Netfilter framework;

[0039] The authentication tunnel module, which is connected to the Netfilter framework through the first detection point, is configured to receive access traffic from the client through the first detection point, perform authentication, and, after successful authentication, initiate the process of establishing a secure communication tunnel with the client.

[0040] The application firewall module, which is connected to the Netfilter framework through the second detection point, is configured to receive data packets sent to the application layer through the second detection point and perform Web attack detection.

[0041] The packet filtering module, which is connected to the Netfilter framework through the third detection point, is configured to receive data packets detected by the application firewall module through the third detection point and perform network layer detection.

[0042] In one possible implementation, the system further includes:

[0043] A log analysis and dynamic policy generation module is connected to the authentication tunnel module, the application firewall module, and the packet filtering module, respectively. This log analysis and dynamic policy generation module is configured as follows:

[0044] The dynamic policy generation module obtains attack logs from the application firewall module and packet filtering logs from the packet filtering module through the log analysis module.

[0045] The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point;

[0046] The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

[0047] Thirdly, embodiments of this application provide a detection device for defending against network attacks based on the Netfilter framework, applied to a defense system, the device comprising:

[0048] The authentication unit sends access traffic from the client to the authentication tunnel module through the first detection point and performs authentication judgment. After successful authentication, the defense system initiates the process of establishing a secure communication tunnel with the client.

[0049] The first detection unit sends the data packets sent to the application layer to the application firewall module through the second detection point, and performs Web attack detection; wherein, the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework;

[0050] The second detection unit sends the data packets detected by the application firewall module to the packet filtering module through the third detection point, and performs network layer detection; wherein, the third detection point is set on the FORWARD chain of the Netfilter framework.

[0051] In one possible implementation, the apparatus further includes a strategy adjustment unit, the strategy adjustment unit being configured to:

[0052] The dynamic policy generation module obtains attack logs from the application firewall module and packet filtering logs from the packet filtering module through the log analysis module.

[0053] The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point;

[0054] The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

[0055] Fourthly, embodiments of this application provide an electronic device, including:

[0056] Memory, used to store computer programs;

[0057] When a processor executes a computer program stored in the memory, it implements the steps of the method described in any of the preceding descriptions.

[0058] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described in any of the above claims.

[0059] The beneficial effects of the embodiments of this application are as follows:

[0060] This application provides a method, system, and apparatus for detecting network attacks based on the Netfilter framework. The detection method is applied to a defense system located between a client and a server the client intends to access. By setting a first detection point on the PREROUTING chain of the Netfilter framework, access traffic from the client is sent to an authentication tunnel module for authentication. Upon successful authentication, the defense system initiates the process of establishing a secure communication tunnel with the client. This allows for identity authentication and the establishment of a secure communication tunnel through the defense system. Furthermore, by setting a second detection point on the PREROUTING chain of the Netfilter framework, data packets destined for the application layer are sent to an application firewall module for web attack detection. This allows for application layer detection through the defense system. Additionally, by setting a third detection point on the FORWARD chain of the Netfilter framework, data packets detected by the application firewall module are sent to a packet filtering module for network layer detection. This allows for network layer detection through the defense system.

[0061] In this way, under the premise of deploying the same defense system, the detection method for defending against network attacks based on the Netfilter framework provided in the embodiments of this application can realize security detection of a single network access in three different dimensions: authentication judgment, application layer detection, and network layer detection. This improves the protection level against network attacks, reduces the network latency of traditional multi-dimensional detection, and reduces the configuration complexity and workload of implementing multi-dimensional security protection. Attached Figure Description

[0062] Figure 1 This is a schematic diagram illustrating an application scenario provided in the embodiments of this application;

[0063] Figure 2 A software architecture diagram applicable to the detection method for defending against network attacks based on the Netfilter framework provided in the embodiments of this application;

[0064] Figure 3 A flowchart illustrating one method of a detection method for defending against network attacks based on the Netfilter framework, provided in this application embodiment;

[0065] Figure 4 A flowchart illustrating one method of a detection method for defending against network attacks based on the Netfilter framework, provided in this application embodiment;

[0066] Figure 5 for Figure 3 Flowchart of the method for step S101;

[0067] Figure 6 for Figure 3 Flowchart of step S102;

[0068] Figure 7 for Figure 3 Flowchart of the method for step S103;

[0069] Figure 8 A flowchart of one method in which both the second and third detection points are enabled in a detection method for defending against network attacks based on the Netfilter framework provided in an embodiment of this application;

[0070] Figure 9 The flowchart illustrates the application layer detection and network layer detection processes in a detection method for defending against network attacks based on the Netfilter framework, as provided in this application embodiment.

[0071] Figure 10 In the detection method for defending against network attacks based on the Netfilter framework provided in the embodiments of this application, Figure 3 Flowchart of one of the methods preceding step S103;

[0072] Figure 11 The flowchart illustrates the process of deploying authentication tunnels by enabling the first, second, and third detection points in a detection method for defending against network attacks based on the Netfilter framework, as provided in this application embodiment.

[0073] Figure 12 The flowchart illustrates the process of deploying a WAF module and a packet filtering module by enabling the first detection point, the second detection point, and the third detection point in a detection method for defending against network attacks based on the Netfilter framework provided in this application embodiment.

[0074] Figure 13 The flowchart illustrates the process of deploying a packet filtering module only at the third detection point in a detection method for defending against network attacks based on the Netfilter framework provided in this application embodiment.

[0075] Figure 14 This application provides a block diagram of one structure of a defense system for defending against network attacks based on the Netfilter framework.

[0076] Figure 15 A block diagram of one embodiment of a detection device for defending against network attacks based on the Netfilter framework provided in this application;

[0077] Figure 16 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0078] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. Furthermore, the embodiments and features in the embodiments of this disclosure can be combined with each other without conflict. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0079] Unless otherwise defined, the technical or scientific terms used in this disclosure shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains. As used in this disclosure, the words “comprising” or “including” and similar terms mean that an element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, but do not exclude other elements or objects.

[0080] In related technologies, it is difficult to establish a secure communication tunnel between the client and the three types of devices. Current deployment methods for defending against network attacks have the following problems: deployment with a single system device results in limited functionality and weak defense; deployment with multiple system devices results in high costs, large access latency, inability to dynamically adjust policies, difficulty in locating problems, and high maintenance complexity.

[0081] In view of this, embodiments of this application provide a detection method, system, and apparatus for defending against network attacks based on the Netfilter framework. The detection method is applied to a defense system located between a client and a server to be accessed by the client. By setting a first detection point on the PREROUTING chain of the Netfilter framework, access traffic from the client is sent to an authentication tunnel module for authentication. After successful authentication, the defense system initiates the process of establishing a secure communication tunnel with the client. In this way, the defense system can perform identity authentication and establish a secure communication tunnel. Furthermore, by setting a second detection point on the PREROUTING chain of the Netfilter framework, data packets destined for the application layer are sent to an application firewall module for web attack detection. In this way, the defense system can achieve application layer detection. Additionally, by setting a third detection point on the FORWARD chain of the Netfilter framework, data packets detected by the application firewall module are sent to a packet filtering module for network layer detection. In this way, the defense system can achieve network layer detection.

[0082] Before providing a detailed explanation of the detection method, system, and apparatus for defending against network attacks based on the Netfilter framework provided in the embodiments of this application, some concepts involved in the embodiments of this application will first be introduced:

[0083] Netfilter is part of the Linux kernel. It provides a framework that allows the kernel and other modules to intercept and manipulate network packets. Netfilter mainly inserts hooks at different points in the network protocol stack (such as packet reception, forwarding, and sending) to filter, modify, or discard packets as they pass through the protocol stack.

[0084] nf_hook: This is the main interface of Netfilter, which allows other kernel modules to register hook functions that will be called at specific points in time.

[0085] PREROUTING: This is part of the iptables firewall rule chain in Linux, belonging to the nat table. When a packet arrives at a Linux system, if that system is configured as a gateway or router, the packet passes through the PREROUTING chain before being routed to its destination. At this stage, the packet can be modified, such as for port forwarding (DNAT) or performing connection-based state checks.

[0086] POSTROUTING: This is part of the iptables rule chain in Linux, also located within the nat table. When packets are about to leave the system and be sent to a network interface, they pass through the POSTROUTING chain. During this stage, operations such as Source Address Translation (SNAT) can be performed to change the source IP address of the packets.

[0087] FORWARD: This is part of the iptables rule chain in Linux, located within the filter table. When packets enter the Linux system from one network interface and need to be routed to another, they pass through the FORWARD chain. At this stage, rules can be set to determine whether packets are allowed to pass, such as filtering based on source IP, destination IP, or protocol type.

[0088] SNAT: Source Network Address Translation, is a technique that modifies the source address of IP packets on network boundary devices.

[0089] DNAT: Destination Network Address Translation, is a form of NAT (Network Address Translation) primarily used to translate the destination address of data packets sent to a specific public IP address into a private IP address within an internal network. When a host on an external network attempts to access a server on the internal network, the NAT device translates the destination address of the data packet from a public IP address to the actual private IP address of the internal server.

[0090] ModSecurity is an open-source Web Application Firewall (WAF) that enhances the security of web servers and protects applications from common web attacks. ModSecurity can run as a module of web servers such as Apache, Nginx, and Microsoft IIS. It blocks malicious activities and attacks, such as SQL injection, cross-site scripting (XSS), and directory traversal attacks, by monitoring, analyzing, and filtering HTTP requests and responses in real time.

[0091] Nginx is a widely used, high-performance HTTP and reverse proxy server software developed by Russian programmer Igor Sysoev. It is renowned for its high stability, rich feature set, high performance, and low resource consumption. Nginx can run as a standalone web server or as a reverse proxy server for load balancing and caching.

[0092] OSI Model: OSI stands for Open System Interconnection. Developed by the International Organization for Standardization (ISO), the OSI model defines standards for interconnecting different computers and serves as the fundamental framework for designing and describing computer network communication. The OSI model divides network communication into seven layers: Physical Layer, Data Link Layer, Network Layer, Transport Layer, Session Layer, Presentation Layer, and Application Layer.

[0093] The following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of this application are applicable. It should be noted that the application scenarios described below are only for illustrating the embodiments of this application and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of this application can be flexibly applied according to actual needs.

[0094] The technical solutions provided in this application can be applied to network attack detection scenarios for various network devices, such as... Figure 1 The diagram illustrates an application scenario provided in this embodiment of the application. This scenario may include a Defense System (DS) 100, a client 200, and a server 300. The application process of the client 200 can access the backend server 300. During the client 200's access to the server 300, the server 300 can perform relevant checks on the access traffic from the client 200. Only after the checks are passed can the client 200 successfully access the server 300.

[0095] It should be noted that, Figure 1The example shown is for illustration only. In reality, the number of clients 200 and servers 300 is unlimited and can be deployed according to the actual application. No limit is set here.

[0096] like Figure 2 The diagram shown illustrates the software architecture applicable to the detection method for defending against network attacks based on the Netfilter framework provided in this application embodiment. Specifically, the defense system 100 includes the following modules:

[0097] Netfilter Framework 110 involves rule configuration for the first, second, and third inspection points, as well as modifications to two nf_hook points. The first and second inspection points are set on the PREROUTING chain of Netfilter Framework 110, while the third inspection point is set on the FORWARD chain. One nf_hook point modification modifies the implementation of the Netfilter kernel hook point in the PREROUTING chain, ensuring that request packets are filtered by the network layer packet filtering rules of the third inspection point in the FORWARD chain before entering the local network. The other nf_hook point modification modifies the implementation of the hook point in the POSTROUTING chain, causing outgoing traffic to re-encode the network layer packet filtering rules of the third inspection point.

[0098] Authentication Tunnel Module 120: Access traffic from client 200, after hitting the first detection point, is sent to authentication tunnel module 120 for processing. This module first verifies the identity information. After successful verification, a virtual IP is randomly generated; for example, the virtual IP algorithm ensures a maximum of 10,000 IPs, and each IP address is unique. Then, the generated virtual IP and the IP of defense system 100 are sent to client 200. Client 200 establishes a secure communication tunnel with defense system 100 based on the received information. In practical implementation, the processing by authentication tunnel module 120 ensures the authenticity of users accessing backend services, effectively preventing identity hijacking attacks. The established secure communication tunnel provides a dedicated access channel for subsequent accesses, improving data transmission security.

[0099] Application Firewall (WF) module 130: Configured to detect access traffic sent to the application layer from the second detection point, limit the number of concurrent connections from the same IP address through the Nginx-based limit_conn_zone module, limit the access volume of the same IP within a certain period through the limit_request module, and limit the traffic of the same IP through the limit_rate provided by the core module; if the access triggers the three restrictions mentioned above, an alert is issued and logs are recorded, and the ModSecurity module embedded in Nginx is used to analyze and filter HTTP requests, record and block malicious activities and attacks.

[0100] Packet filtering module 140: This is a module deployed at the third detection point. Packet filtering module 140 is configured to detect various DoS attacks and to filter and control the five-tuple (source and destination IP, source and destination port, protocol) of the traffic detected by the WAF module.

[0101] The log analysis and dynamic policy generation module 150 is configured to collect alarm logs generated by the WAF module and packet filtering module 140. It performs a comprehensive analysis of four dimensions—concurrent connections from the same IP, access volume from the same IP over a certain period, traffic from the same IP, and URL attack details from the same IP—based on logs generated from three Nginx limit points and attack logs recorded by Modsecurity. Based on the blocking threshold set by the administrator, it determines whether to notify the first detection point authentication tunnel module 120 to kick out the user and disconnect the tunnel, or to generate a network layer packet filtering blocking policy to block the IP at the third detection point, or to simultaneously strengthen attack defense measures from the first and third detection points. It also analyzes the network layer packet filtering logs to determine if there are typical attacks such as network layer DDoS, and dynamically adjusts the first detection point policy based on the results, directly kicking out the user and disconnecting the tunnel, blocking the attack at the very beginning of the traffic processing kernel protocol stack, effectively reducing the system's CPU load. Through the above analysis of different attack scenarios, it generates the smallest granularity strategy for effective attack defense, while minimizing the impact on the network environment.

[0102] It should be noted that Figure 2 The components and structures shown in the functional module architecture diagram are merely exemplary and not restrictive. In real-world scenarios, other components and structures may be included as needed.

[0103] The network attack detection method provided by the exemplary embodiments of this application will be described below with reference to the accompanying drawings and the application scenarios described above. It should be noted that the application scenarios described above are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0104] like Figure 3The diagram shows a method flowchart for a network attack detection method based on the Netfilter framework 110 provided in this application embodiment. The detection method is applied to the aforementioned defense system 100, which is located between the client 200 and the server 300 to be accessed. Specifically, the detection method includes:

[0105] S101: The access traffic from the client is sent to the authentication tunnel module through the first detection point and authentication is performed. After successful authentication, the defense system initiates the process of establishing a secure communication tunnel with the client.

[0106] In the specific implementation process, the process by which the authentication tunnel module 120 processes the access traffic from the client 200 can be referred to the description in the relevant sections above, and will not be described in detail here.

[0107] S102: The data packets sent to the application layer are sent to the application firewall module through the second detection point, and Web attack detection is performed; wherein, the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework;

[0108] In the specific implementation process, the processing of data packets sent through the second detection point by the application firewall module 130 can be referred to the description in the relevant parts mentioned above, and will not be described in detail here.

[0109] S103: The data packets detected by the application firewall module are sent to the packet filtering module through the third detection point for network layer detection; wherein, the third detection point is set on the FORWARD chain of the Netfilter framework.

[0110] In the specific implementation process, the packet filtering module 140 performs network layer detection on the data packets that have passed through the third detection point and been detected by the application firewall module 130. This process can be referred to the description in the relevant parts above, and will not be described in detail here.

[0111] In this embodiment, by setting a first detection point, a second detection point, and a third detection point at three key locations using the Netfilter framework 110, multi-dimensional defense detection can be achieved. In this way, a single defense system 100 can simultaneously defend against network layer and application layer network attacks, as well as provide secure identity authentication tunnels, without the need to deploy multiple systems or devices, thus saving defense costs.

[0112] In this embodiment, the defense system 100 further includes a log analysis and dynamic policy generation module 150 connected to the authentication tunnel module 120, the application firewall module 130, and the packet filtering module 140, respectively. Figure 4 As shown, the method further includes:

[0113] S201: The dynamic policy generation module obtains attack logs from the application firewall module and packet filtering logs from the packet filtering module through the log analysis module;

[0114] S202: Analyze the attack logs and generate defense blocking strategies for the first detection point and the third detection point;

[0115] S203: Analyze the packet filtering logs and generate a control policy for the first detection point to block the attack at the very beginning of the processing traffic kernel protocol stack.

[0116] In practical implementation, the network attack detection method based on the Netfilter framework 110 provided in this application embodiment can not only detect network attacks, but also achieve targeted defense against network attacks through the log analysis and dynamic policy generation module 150. The process of the log analysis and dynamic policy generation module 150 analyzing logs from multiple dimensions and generating coordinated defense strategies for each module can be referred to the description in the aforementioned relevant sections, and will not be detailed here.

[0117] In this embodiment of the application, step S202: analyze the attack logs and generate a defense blocking strategy for the first detection point and the third detection point, including one of the following:

[0118] The authentication tunnel module is notified through the first detection point to kick out the user accessing the client and disconnect the secure communication tunnel;

[0119] By generating a packet filtering blocking policy targeting the network layer, the IP address of the accessing user is blocked at the third detection point.

[0120] Attack defense measures are strengthened at both the first and third detection points.

[0121] It should be noted that various defense strategies against network attacks can also be generated according to actual application needs, which will not be detailed here.

[0122] In the embodiments of this application, such as Figure 5 As shown, step S101: The access traffic from the client is sent to the authentication tunnel module through the first detection point, and authentication is performed, including:

[0123] S301: After the access traffic from the client hits the first detection point, the access traffic enters the authentication tunnel module;

[0124] S302: The authentication tunnel module authenticates the identity information of the accessing user from the client;

[0125] S303: Login will be denied if authentication fails;

[0126] S304: If authentication is successful, a virtual IP is assigned to the client, and the virtual IP and the IP of the defense system are sent to the client to establish a secure communication tunnel between the client and the defense system.

[0127] In the specific implementation process, steps S301 to S304 are implemented as follows:

[0128] First, client 200 accesses backend server 300. The packet arrives at client 200, is processed by the physical network card, and then sent to server 300. Next, the data stream of the access service is filtered and authenticated at the first detection point. If server 300 is configured with an "authenticate-before-access" policy, direct access to server 300 is not allowed; local authentication is required. Specifically, after DNAT, the data packet is routed to the local LOCAL_IN for authentication and secure communication tunnel establishment. Then, the identity information of the accessing user from client 200 is authenticated. After successful authentication, a virtual IP is randomly generated. The virtual IP algorithm ensures a maximum of 10,000 unique IP addresses. The generated virtual IP and the IP of defense system 100 are sent to client 200 to establish a secure communication tunnel between client 200 and defense system 100.

[0129] In this embodiment, the application firewall module includes an Nginx-based limit_conn_zone module, limit_request module, core module, and ModSecurity module, such as... Figure 6 As shown, step S102: The data packets sent to the application layer are sent to the application firewall module through the second detection point, and web attack detection is performed, including:

[0130] S401: The data packet sent to the application layer is sent to the limit_conn_zone module, the limit_request module, the core module, and the ModSecurity module through the second detection point;

[0131] S402: Limit the number of concurrent connections to the same IP address using the limit_conn_zone module;

[0132] S403: Limit the number of accesses from the same IP address within a specific time period using the limit_request module;

[0133] S404: Limit traffic to the same IP address using the limit_rate provided by the core module;

[0134] S405: If the access traffic is detected to trigger restrictions on the limit_conn_zone module, the limit_request module, and the core module, an alarm is issued and the corresponding logs are recorded;

[0135] S406: The ModSecurity module analyzes the attack details of URLs allowed by Nginx, records, and blocks malicious activities and attack behaviors.

[0136] In the embodiments of this application, such as Figure 7 As shown, step S103: The data packets detected by the application firewall module are sent to the packet filtering module through the third detection point, and network layer detection is performed, including:

[0137] S501: The data packets detected by the application firewall module are sent to the packet filtering module through the third detection point;

[0138] S502: The packet filtering module detects whether there is a network layer DOS attack and performs filtering control on the five-tuples of the data packets detected by the application firewall module.

[0139] In the embodiments of this application, such as Figure 8 As shown, if both the second detection point and the third detection point are enabled, before step 1: applying the firewall module to detect Web attack types, the method further includes:

[0140] S601: If the server accessed by the client through the defense system is configured with an application firewall protection policy, the access traffic hits the second detection point, and the application firewall filters the data packets sent to the application layer to obtain the filtered data packets.

[0141] S602: By modifying the kernel code of the hook point of the PREROUTING chain, the packet filtering policy of the third detection point is called again to filter the filtered data packets, which are then redirected to the local area of ​​the defense system so that the application firewall module can detect web attack types.

[0142] It should be noted that, in order to clearly illustrate the specific processes of application layer detection and network layer detection, in one exemplary embodiment, in combination with... Figure 9The processing flow shown provides a detailed explanation of the steps involved after both the second and third detection points are activated.

[0143] In practical implementation, a WAF module can be deployed at the second detection point, and a packet filtering module 140 can be deployed at the third detection point, thereby achieving defense against network layer attacks and application layer attacks. Combined with... Figure 9 The exemplary embodiment shown is described in detail below:

[0144] ① A client process (e.g., an app process) accesses server 300 in the "WAF security policy" list;

[0145] ②The request message is sent directly to the server 300 after passing through the client's physical network card 200;

[0146] ③ The request packet passes through defense system 100. At the second detection point, the request packet to access server 300 is filtered through the PREROUTING chain NAT table. If server 300 is configured with WAF protection policy, it will be hit. After the hit, the request packet will first pass through the packet filtering policy (the third detection point, which is implemented by modifying the Netfilter kernel hook point, so that the policy of the third detection point on the FORWARD chain is passed once before the request packet enters the local machine) and then be redirected to the local machine of defense system 100. The redirection performs DNAT on the data packet: the destination IP (i.e., the server IP) is changed to the defense system IP. If it is not hit, the request packet is directly forwarded to the FORWARD chain.

[0147] ④ Request packets that do not match the WAF policy are forwarded to the backend server 300 after being filtered by the third checkpoint on the FORWARD chain and the packet is matched with the "allow" policy.

[0148] ⑤ Request packets redirected to the local machine by the WAF policy are processed and filtered by the WAF process; after filtering by the WAF process, the proxy access server returns a 300 error. At this time, the data packet is: source - client IP, destination - server IP.

[0149] ⑥ The request packet is routed and then sent to the server 300.

[0150] It should be noted that, in this embodiment, the same data packet can be sequentially passed through the network layer and application layer for detection by modifying the key hook point code of Netfilter. When the second and third detection points are enabled, the kernel code of the hook point in the PREROUTING chain can be modified to re-invoke the packet filtering rules of the third detection point to filter and control the access data packet before the request packet is sent to the local WAF module for detection. This breaks through the traditional Netfilter framework's 110 traffic flow restriction, namely, the restriction that data passing through the FORWARD chain cannot be sent to the local processing. In this way, the same access data packet can return to the local processing center for application layer WAF module detection after being detected by the packet filtering of the FORWARD chain.

[0151] In this embodiment of the application, if the first detection point, the second detection point, and the third detection point are all activated, such as Figure 10 As shown, before step S103: sending the data packets detected by the application firewall module to the packet filtering module via the third detection point, the method further includes:

[0152] S701: The data packet detected by the application firewall module is sent to the POSTROUTING chain, where the SNAT translation rule is matched, and the translated data packet is obtained; wherein, the POSTROUTING chain is located on the Netfilter framework;

[0153] S702: By modifying the kernel code of the hook point of the POSTROUTING chain, the converted data packet is sent to the packet filtering module so that the packet filtering module can perform network layer detection.

[0154] It should be noted that, in order to clearly illustrate the specific processes of identity authentication, application layer detection, and network layer detection, in one exemplary embodiment, [the following is combined with...] Figure 11 and Figure 12 The processing flow shown provides a detailed explanation of the steps involved after the first, second, and third detection points are all activated.

[0155] In practical implementation, an authentication tunnel module 120 can be deployed at the first detection point, a WAF module at the second detection point, and a packet filtering module 140 at the third detection point, thereby achieving defense against identity authentication security tunnels, network layer attacks, and application layer attacks. (This is still combined with...) Figure 11 and Figure 12 The exemplary embodiment shown is described in detail below:

[0156] First, according to Figure 11 The following is a detailed process for deploying an authentication tunnel:

[0157] ① Client process 200 accesses backend server 300;

[0158] ② After the message arrives at the client's 200 physical network card for processing, the data packet is sent to the server 300;

[0159] ③The PREROUTING chain (first detection point) filters the data stream of the access service and performs "authentication" judgment. Server 300 is configured with the "authentication first" policy, so direct access to server 300 is not allowed at this time and local authentication is required.

[0160] ④ After DNAT is performed, the data packet is sent to the local LOCALIN for authentication, secure channel establishment and business processing via routing selection;

[0161] ⑤ Verify the identity information. After successful verification, a virtual IP is randomly generated. The virtual IP algorithm guarantees a maximum of 10,000 IPs, and each IP address is unique. The generated virtual IP and the IP of the defense system 100 are sent to the client 200. The client 200 establishes a secure tunnel with the defense system 100 based on the received information. During subsequent communication through the tunnel, the client 200 encapsulates the virtual IP, the server IP, and the payload. When exiting through the network card, the real IP and the defense system IP are encapsulated in the packet header.

[0162] It should be noted that, in this embodiment, the policy access through the first detection point can achieve the functions of identity authentication and establishing a secure tunnel. In specific implementation, the first layer of defense can be implemented at the access layer, and the core functions are the tunnel establishment conditions, the client's 200-pair packet encapsulation, and the defense system's 100-pair packet decapsulation process.

[0163] Secondly, after identity verification, the process involves secure communication tunnel encapsulation, WAF filtering, and packet filtering, as follows: Figure 12 As shown, specifically:

[0164] ① The client's 200 process routes to the virtual network interface card: sets the source IP to the virtual IP and sends a request packet;

[0165] ② Data packets conforming to the tunneling policy are routed to the virtual network interface card (NIC) for encapsulation;

[0166] ③ The message is encapsulated by the physical network card. After processing, the data packet is: source - client real IP, destination - defense system IP, and the virtual IP is encapsulated into the IP payload;

[0167] ④ After receiving the tunnel message, the defense system 100 sends it to the local protocol stack for processing through routing lookup;

[0168] ⑤ After the local protocol stack checks the validity of the tunnel packet, it decapsulates it and resends it back to the routing forwarding. At this time, the source IP is a virtual IP.

[0169] ⑥ The data packet is re-passed through PREROUTING. If it does not hit the "pass after authentication" policy, it passes; if it hits the WAF policy, the data packet is redirected (DNAT) to the local machine.

[0170] ⑦ The data packet is sent to the WAF process for processing, where application layer filtering and detection are performed on the data packet;

[0171] ⑧ After the WAF process is completed, the proxy sends a request message to the server via a 300 status code: source - virtual IP, destination - server IP;

[0172] ⑨ The data packet passes through POSTROUTING and hits the Source Address Translation (SNAT) rule, source - client real IP, destination - server IP; after translation, it passes through the packet filtering policy, and if allowed, it is sent to the backend server with a 300 error (here, the implementation of the Netfilter kernel hook point needs to be modified to call the packet filtering policy of the third detection point before the request packet leaves the system).

[0173] ⑩ The data packet is sent to the backend server via 300.

[0174] It should be noted that, in this embodiment, by modifying the Netfilter key hook point code, the same data packet can sequentially pass through the security tunnel, authentication, application layer inspection, and network layer inspection. When the first, second, and third inspection points are enabled, by modifying the kernel code of the POSTROUTING chain hook point, data packets that have passed the inspection by the local WAF module are re-invoked for filtering control using the packet filtering rules of the third inspection point. This breaks through the traditional Netfilter framework's 110 traffic flow restriction, meaning that data entering the POSTROUTING chain cannot be sent to the FORWARD chain for processing. In this way, the same access data packet can be inspected by the network layer packet filtering rules after passing the inspection by the application layer WAF module.

[0175] In one exemplary embodiment, the packet filtering module 140 may be deployed only at the third detection point to achieve network layer attack defense. The following describes... Figure 13 The diagram shown provides a detailed explanation of the data transmission process when only the third detection point is activated:

[0176] ① Client process 200 accesses backend server 300;

[0177] ②The message arrives at the client 200, is processed by the physical network card, and then the processed data packet is sent to the server 300;

[0178] ③ After routing selection, data packets destined for the business IP are sent to the FORWARD node and filtered by the packet filtering policy;

[0179] ④ If the packet filtering policy configured on the backend server 300 is "allow", the data packet will be sent to the backend server 300.

[0180] It should be noted that, in this embodiment, the first, second, and third detection points can be combined in different ways according to actual application needs. For example, the choice of whether to enable all or part of the three detection points can be made by comprehensively considering factors such as network environment requirements, security level requirements, and the basic resource requirements for the operation of the defense system 100. In one exemplary embodiment, only the authentication tunnel module 120 and the WAF module may be deployed. In another exemplary embodiment, only the authentication tunnel module 120 and the packet filtering module 140 may be deployed. Of course, other deployment methods are also possible and are not limited here. In this way, the defense system 100 provided in this embodiment has highly coordinated and unified triple defense functions, and can enable multiple combination modes according to actual application needs. Authentication tunnel, application layer protection, and network layer protection can be enabled individually or in arbitrary combinations. Throughout the implementation process, the defense mode is flexible and the deployment can be changed according to defense requirements and actual network changes.

[0181] In this embodiment, under the same protection level requirements, access service latency is effectively reduced. An access data packet passes sequentially through the authentication tunnel, network layer, and application layer defense detection points within the same detection framework. There is no forwarding of data packets by different system devices, and no copying and recovery process of traffic occurs during the detection process, effectively reducing access service latency.

[0182] Furthermore, the detection method provided in this application effectively reduces the difficulty of operation and maintenance and the workload of deployment; the three-dimensional integrated function combination allows for the provision of three defense functions with only one deployment point in the network requiring protection, reducing the difficulty and workload of network planning. The defense policies of the three detection points can be viewed and modified at any time within the same system, eliminating the need to log into different system devices to view and modify policies of different network nodes, thus reducing the difficulty of operation and maintenance.

[0183] Based on the same inventive concept, such as Figure 14 As shown in the illustration, this application also provides a defense system 100 for defending against network attacks based on the Netfilter framework 110. The defense system 100 is located between a client 200 and a server 300 that the client 200 needs to access. The system includes:

[0184] The first and second detection points are respectively set on the PREROUTING chain, and the third detection point is set on the FORWARD chain; wherein the PREROUTING chain and the FORWARD chain are located on the Netfilter framework 110;

[0185] The authentication tunnel module 120, which is connected to the Netfilter framework 110 through the first detection point, is configured to receive access traffic from the client 200 through the first detection point, perform authentication, and after successful authentication, the defense system 100 initiates the process of establishing a secure communication tunnel with the client 200.

[0186] The application firewall module 130, which is connected to the Netfilter framework 110 through the second detection point, is configured to receive data packets sent to the application layer through the second detection point and perform Web attack detection.

[0187] The packet filtering module 140, which is connected to the Netfilter framework 110 through the third detection point, is configured to receive data packets detected by the application firewall module 130 through the third detection point and perform network layer detection.

[0188] In this embodiment of the application, the system further includes:

[0189] A log analysis and dynamic policy generation module 150, which is connected to the authentication tunnel module 120, the application firewall module 130, and the packet filtering module 140 respectively, is configured as follows:

[0190] The dynamic policy generation module 150 obtains attack logs from the application firewall module 130 and packet filtering logs from the packet filtering module 140 through the log analysis.

[0191] The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point;

[0192] The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

[0193] Of course, the principle by which this defense system 100 solves the problem is similar to that of the defense system 100 mentioned above. Therefore, the connection relationship between the various modules included in the defense system 100, as well as the specific functions of each module, can be referred to the description in the relevant parts mentioned above. Repeated descriptions will not be repeated here.

[0194] Based on the same inventive concept, such as Figure 15 As shown in the illustration, this application also provides a detection device for defending against network attacks based on the Netfilter framework 110, applied to a defense system 100. The device includes:

[0195] The authentication unit 10 sends the access traffic from the client 200 to the authentication tunnel module 120 through the first detection point and performs authentication. After the authentication is successful, the defense system 100 starts the process of establishing a secure communication tunnel with the client 200.

[0196] The first detection unit 20 sends the data packets sent to the application layer to the application firewall module 130 through the second detection point, and performs Web attack detection; wherein, the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework 110;

[0197] The second detection unit 30 sends the data packets detected by the application firewall module 130 to the packet filtering module 140 through the third detection point, and performs network layer detection; wherein, the third detection point is set on the FORWARD chain of the Netfilter framework 110.

[0198] In this embodiment of the application, the device further includes a strategy adjustment unit 40, which is specifically used for:

[0199] The dynamic policy generation module 150 obtains attack logs from the application firewall module 130 and packet filtering logs from the packet filtering module 140 through the log analysis.

[0200] The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point;

[0201] The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

[0202] It should be noted that the specific structural connections and corresponding functions of the defense system 100, client 200, server 300, Netfilter framework 110, authentication tunnel module 120, application firewall module 130, packet filtering module 140, and log analysis and dynamic policy generation module 150 mentioned in the embodiments of this application can be referred to the descriptions of the relevant parts above, and will not be repeated here.

[0203] In this embodiment of the application, the strategy adjustment unit 40 is specifically used to perform one of the following:

[0204] The authentication tunnel module 120 is notified through the first detection point to kick out the user accessing the client 200 and disconnect the secure communication tunnel;

[0205] By generating a packet filtering blocking policy targeting the network layer, the IP address of the accessing user is blocked at the third detection point.

[0206] Attack defense measures are strengthened at both the first and third detection points.

[0207] In this embodiment of the application, the authentication unit 10 is specifically used for:

[0208] After the access traffic from the client 200 hits the first detection point, the access traffic enters the authentication tunnel module 120;

[0209] The authentication tunnel module 120 authenticates the identity information of the accessing user from the client 200.

[0210] If authentication fails, login will be denied.

[0211] If authentication is successful, a virtual IP is assigned to the client 200, and the virtual IP and the IP of the defense system 100 are sent to the client 200 to establish a secure communication tunnel between the client 200 and the defense system 100.

[0212] In this embodiment, the application firewall module includes an Nginx-based limit_conn_zone module, limit_request module, core module, and ModSecurity module. The first detection unit 20 is specifically used for:

[0213] The data packets sent to the application layer are transmitted through the second detection point to the limit_conn_zone module, the limit_request module, the core module, and the ModSecurity module;

[0214] The limit_conn_zone module limits the number of concurrent connections from the same IP address.

[0215] The limit_request module is used to limit the number of accesses from the same IP address within a specific time period;

[0216] The traffic to the same IP address is limited by the limit_rate provided by the core module;

[0217] If the access traffic is detected to have triggered restrictions on the limit_conn_zone module, the limit_request module, and the core module, an alarm will be triggered and the corresponding logs will be recorded.

[0218] The ModSecurity module analyzes attack details of URLs allowed by Nginx, recording and blocking malicious activities and attacks.

[0219] In this embodiment of the application, the second detection unit 30 is specifically used for:

[0220] The data packets detected by the application firewall module 130 are sent to the packet filtering module 140 through the third detection point;

[0221] The packet filtering module 140 detects whether there is a network layer DOS attack and filters the five-tuples of the data packets detected by the application firewall module 130.

[0222] In this embodiment of the application, if both the second detection point and the third detection point are enabled, before the application firewall module 130 performs Web attack detection, the detection device includes a first processing unit, which is specifically used for:

[0223] If the server 300 accessed by the client 200 through the defense system 100 is configured with an application firewall protection policy, then the access traffic hits the second detection point, and the application firewall filters the data packets sent to the application layer to obtain the filtered data packets.

[0224] By modifying the kernel code of the hook point in the PREROUTING chain, the packet filtering policy of the third detection point is called again to filter the filtered data packets, which are then redirected to the local machine of the defense system 100, so that the application firewall module 130 can perform web attack detection.

[0225] In this embodiment of the application, if the first detection point, the second detection point, and the third detection point are all enabled, before the data packet detected by the application firewall module 130 is sent to the packet filtering module 140 through the third detection point, the detection device further includes a second processing unit, which is specifically used for:

[0226] The data packets detected by the application firewall module 130 are sent to the POSTROUTING chain, where the SNAT translation rule is hit, and the translated data packets are obtained; wherein, the POSTROUTING chain is located on the Netfilter framework 110;

[0227] By modifying the kernel code of the hook point of the POSTROUTING chain, the converted data packet is sent to the packet filtering module 140 so that the packet filtering module 140 performs network layer detection.

[0228] Based on the same inventive concept, this application also provides an electronic device that can realize the function of the aforementioned detection device for defending against network attacks based on the Netfilter framework 110. (Refer to...) Figure 16 The electronic device includes:

[0229] Memory 400 is used to store computer programs;

[0230] When the processor 500 executes the computer program stored in the memory 400, it implements the detection method steps for defending against network attacks based on the Netfilter framework 110 as described in any of the preceding items.

[0231] In this embodiment, the specific connection medium between the processor 500 and the memory 400 is not limited. Figure 16 The example shown is the connection between processor 500 and memory 400 via bus 600. Bus 600 is... Figure 16 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 600 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 16 The term "processor 500" is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, "processor 500" can also be called "controller," and there are no restrictions on the name.

[0232] In this embodiment, the memory 400 stores instructions executable by the processor 500. When the processor 500 executes the computer program stored in the memory 400, it can execute the detection method for defending against network attacks based on the Netfilter framework 110 discussed above. The processor 500 can implement... Figure 14 The functions of each module are shown.

[0233] The processor 500 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing computer programs stored in the memory 400 and calling data stored in the memory 400, the various functions of the device and the data processing are monitored as a whole.

[0234] In one possible design, processor 500 may include one or more processing units. Processor 500 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. In some embodiments, processor 500 and memory 400 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0235] Memory 400, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 400 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Alternatively, memory 400 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. Memory 400 in the embodiments of this application may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0236] By designing and programming the processor 500, the code corresponding to the detection method for defending against network attacks based on the Netfilter framework described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the steps of the detection method for defending against network attacks based on the Netfilter framework 110 discussed above during runtime. How to design and program the processor 500 is a technique well-known to those skilled in the art, and will not be elaborated here.

[0237] Based on the same inventive concept, this application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by the processor 500, it implements the detection method for defending against network attacks based on the Netfilter framework 110 discussed above.

[0238] In some possible implementations, various aspects of the detection method for defending against network attacks based on the Netfilter framework 110 provided in this application can also be implemented in the form of a program product, which includes program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in the detection method for defending against network attacks based on the Netfilter framework according to various exemplary embodiments of this application described above.

[0239] This application provides a method, system, and apparatus for detecting network attacks based on the Netfilter framework 110. The detection method is applied to a defense system 100 located between a client 200 and a server 300 that the client 200 is trying to access. By setting a first detection point on the PREROUTING chain of the Netfilter framework 110, access traffic from the client 200 can be sent to an authentication tunnel module 120 for authentication. After successful authentication, the defense system 100 initiates the process of establishing a secure communication tunnel with the client 200. In this way, the defense system 100 can perform identity authentication and establish a secure communication tunnel. Furthermore, by setting a second detection point on the PREROUTING chain of the Netfilter framework 110, data packets destined for the application layer can be sent to an application firewall module 130 for Web attack detection. Thus, the defense system 100 can achieve application layer detection. Furthermore, by setting a third inspection point on the FORWARD chain of the Netfilter framework 110, data packets inspected by the application firewall module 130 can be sent to the packet filtering module 140 for network layer inspection. In this way, network layer inspection can be achieved through the defense system 100.

[0240] In this way, under the premise of deploying the same defense system 100, the detection method for defending against network attacks based on the Netfilter framework 110 provided in this application embodiment can realize security detection of a single network access in three different dimensions: authentication judgment, application layer detection, and network layer detection. This improves the protection level against network attacks, reduces the network latency of traditional multi-dimensional detection, and reduces the configuration complexity and workload of implementing multi-dimensional security protection.

[0241] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0242] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0243] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0244] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0245] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A detection method for defending against network attacks based on the Netfilter framework, applied to a defense system, characterized in that, The defense system is located between the client and the server that the client wants to access, and the method includes: The access traffic from the client is sent to the authentication tunnel module through the first detection point for authentication. After successful authentication, the defense system initiates the process of establishing a secure communication tunnel with the client. The data packets sent to the application layer are sent to the application firewall module through the second detection point, and Web attack detection is performed; wherein, the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework; The data packets detected by the application firewall module are sent to the packet filtering module through the third detection point for network layer detection; wherein, the third detection point is set on the FORWARD chain of the Netfilter framework; The defense system further includes a log analysis and dynamic policy generation module connected to the authentication tunnel module, the application firewall module, and the packet filtering module, respectively. The method further includes: The dynamic policy generation module obtains attack logs from the application firewall module and packet filtering logs from the packet filtering module through the log analysis module. The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point; The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

2. The method as described in claim 1, characterized in that, The step of analyzing the attack logs to generate defense and blocking strategies for the first and third detection points includes one of the following: The authentication tunnel module is notified through the first detection point to kick out the user accessing the client and disconnect the secure communication tunnel; By generating a packet filtering blocking policy targeting the network layer, the IP address of the accessing user is blocked at the third detection point. Attack defense measures are strengthened at both the first and third detection points.

3. The method as described in claim 1, characterized in that, The step of sending access traffic from the client into the authentication tunnel module through the first detection point and performing authentication determination includes: After the access traffic from the client hits the first detection point, the access traffic enters the authentication tunnel module; The authentication tunnel module authenticates the identity information of the accessing user from the client. If authentication fails, login will be denied. If authentication is successful, a virtual IP is assigned to the client, and the virtual IP and the IP of the defense system are sent to the client to establish a secure communication tunnel between the client and the defense system.

4. The method as described in claim 1, characterized in that, The step of sending the data packets detected by the application firewall module to the packet filtering module through the third detection point and performing network layer detection includes: The data packets detected by the application firewall module are sent to the packet filtering module through the third detection point; The packet filtering module detects whether there is a network layer DoS attack and filters the five-tuples of data packets detected by the application firewall module.

5. The method as described in claim 1, characterized in that, If both the second detection point and the third detection point are enabled, before the application firewall module performs web attack detection, the method further includes: If the server accessed by the client through the defense system is configured with an application firewall protection policy, the access traffic hits the second detection point, and the application firewall filters the data packets sent to the application layer to obtain filtered data packets. By modifying the kernel code of the hook point in the PREROUTING chain, the packet filtering policy of the third detection point is invoked again to filter the filtered data packets, which are then redirected to the local area of ​​the defense system, so that the application firewall module can detect web attack types.

6. A defense system for defending against network attacks based on the Netfilter framework, characterized in that, The defense system is located between the client and the server that the client wants to access, and the system includes: The first and second detection points are respectively set on the PREROUTING chain, and the third detection point is set on the FORWARD chain; wherein the PREROUTING chain and the FORWARD chain are located on the Netfilter framework; The authentication tunnel module, which is connected to the Netfilter framework through the first detection point, is configured to receive access traffic from the client through the first detection point, perform authentication, and, after successful authentication, initiate the process of establishing a secure communication tunnel with the client. The application firewall module, which is connected to the Netfilter framework through the second detection point, is configured to receive data packets sent to the application layer through the second detection point and perform Web attack detection. The packet filtering module, which is connected to the Netfilter framework through the third detection point, is configured to receive data packets detected by the application firewall module through the third detection point and perform network layer detection. The system also includes: A log analysis and dynamic policy generation module, which is connected to the authentication tunnel module, the application firewall module, and the packet filtering module respectively, is configured as follows: Obtain attack logs from the application firewall module and packet filtering logs from the packet filtering module; The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point; The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

7. A detection device for defending against network attacks based on the Netfilter framework, applied to a defense system, characterized in that, The device includes: The authentication unit sends access traffic from the client to the authentication tunnel module through the first detection point and performs authentication judgment. After successful authentication, the defense system initiates the process of establishing a secure communication tunnel with the client. The first detection unit sends the data packets sent to the application layer to the application firewall module through the second detection point, and performs Web attack detection; wherein, the second detection point and the first detection point are respectively set on the PREROUTING chain of the Netfilter framework; The second detection unit sends the data packets detected by the application firewall module to the packet filtering module through the third detection point, and performs network layer detection; wherein, the third detection point is set on the FORWARD chain of the Netfilter framework; The device further includes a strategy adjustment unit, which is specifically used for: A dynamic policy generation module is generated by analyzing logs connected to the authentication tunnel module, the application firewall module, and the packet filtering module, respectively, to obtain attack logs from the application firewall module and packet filtering logs from the packet filtering module. The attack logs are analyzed to generate defense and blocking strategies for the first detection point and the third detection point; The packet filtering logs are analyzed to generate a control policy for the first detection point, in order to block attacks at the very beginning of the traffic processing kernel protocol stack.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method steps of any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-5.

Images