IPv6 fragment bypassing threat detection method and system based on eBPF and XDP

Abstract

The invention relates to the technical field of network security, in particular to an IPv6 fragment bypassing threat detection method and system based on eBPF and XDP, a data packet observation point is arranged on a network driver layer, and the data packet observation point is used for mounting an eBPF program on a data packet processing path by using a fast data path XDP technology; for data packets received on a network driver layer, an eBPF program on an XDP network hook is called by using a data packet observation point, and data packets with potential threats are identified and filtered by using a feature matching strategy through the eBPF program. The feature matching strategy is used for extracting key features of the data packet, matching the extracted key features of the data packet with target threat features and judging whether an upper header of the data packet is complete or not. According to the method, the specific threat efficient detection is realized by combining the eBPF dynamic programmability and the XDP high-performance data packet processing capability, the IPv6 network security threat high-performance solution task requirements are met, and the influence on the system stability is small even under serious threats.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an IPv6 fragmentation bypass threat detection method and system based on eBPF and XDP. Background Art

[0002] With the global large-scale deployment and application of IPv6, security threats and security incidents in IPv6 networks have also increased, especially security issues in IPv6 extension headers. IPv6 extension headers bring greater flexibility and scalability to the protocol, but also cause many new security issues. For example, the complexity of IPv6 extension headers makes it easy for operating systems to have vulnerabilities when processing abnormal data packets, thus causing serious risks such as remote code execution or denial of service (DoS) threats.

[0003] The IPv6 fragment header is one of the IPv6 extension headers, which is responsible for implementing the fragmentation function of data packets. However, its complexity also provides opportunities for threat actors to exploit. Over the years, researchers have discovered a variety of security vulnerabilities based on the IPv6 fragment header, such as fragment overlap and atomic fragmentation. These vulnerabilities may lead to IPv6 fragment bypass threats that may cause DoS threats, intrusion detection systems (IDS) and firewalls and other security systems to fail to defend. This security system bypass threat refers to the threat actor using the IPv6 fragment header mechanism to construct special IPv6 data packets, so that these data packets that should have been rejected by the security system can pass the detection smoothly and be received by the target system.

[0004] To deal with the IPv6 fragment bypass threat, RFC (Request for Comments) 7112 proposes that when a host fragments an IPv6 data packet, the first fragment must contain complete upper-layer protocol information. If an IPv6 host receives a data packet that does not meet this requirement, it should discard the data packet and send an ICMPv6 error message. However, as a theoretical solution to the IPv6 fragment bypass threat, existing studies have shown that not all network devices and operating systems can fully comply with the RFC 7112 specification. Although RFC 7112 was proposed as a theoretical solution to the IPv6 fragment bypass threat, it has not been widely implemented in current protection systems and devices. At present, there is a lack of a general solution that can actively detect IPv6 fragment bypass threats. In addition, although there have been some studies that can detect specific categories of IPv6 threats, these methods are often limited to specific application scenarios and lack sufficient scalability. Moreover, most existing solutions are based on user-mode implementation, which has high performance overhead problems in large-scale traffic environments and cannot meet the needs of actual deployment. Summary of the invention

[0005] To this end, the present invention provides an IPv6 fragmentation bypass threat detection method and system based on eBPF and XDP to solve the problems of the existing IPv6 fragmentation bypass threat detection technology, such as few identification types and poor detection performance.

[0006] According to the design scheme provided by the present invention, on the one hand, a method for detecting IPv6 fragment bypass threats based on eBPF and XDP is provided, comprising:

[0007] Setting a data packet observation point at the network driver layer, wherein the data packet observation point is used to mount the extended Berkeley packet filter eBPF program on the data packet processing path using the fast data path XDP technology;

[0008] For the data packets received on the network driver layer, the eBPF program on the XDP network hook is called using the data packet observation point. The eBPF program uses the feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract the key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packet is complete.

[0009] As an IPv6 fragmentation bypass threat detection method based on eBPF and XDP of the present invention, further, in the eBPF program, two address variables are used to point to the starting address and the ending address of the Ethernet data frame received by the network driver layer respectively, and the address variable data type is converted into a pointer to extract the IP layer data message and the TCP / UDP layer data message through the address variable.

[0010] As the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of the present invention, further, using the feature matching strategy through the eBPF program to identify and filter data packets with potential threats, it includes:

[0011] Parsing data packets layer by layer starting from the Ethernet data frame, and filtering out potential target data packets from the IPv6 data packets, wherein the potential target data packet is the first fragmented data packet in the IPv6 fragmented data packets;

[0012] Parse the header fields of potential target data packets and obtain key fields in the extended header of the data packet; extract key features related to the threat from the key fields of the data packet header; match the extracted key features with the target threat features;

[0013] If the match is successful, the potential target data packet is determined to be a threat and a packet drop operation is performed. Otherwise, the potential target data packet is determined to be a safe data packet and an operation of allowing the data packet to enter the network protocol stack is performed.

[0014] As the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of the present invention, further, starting from the Ethernet data frame, the data packet is parsed layer by layer, and the potential target data packet is filtered out from the IPv6 data packet, including:

[0015] Starting from the Ethernet data frame, the IPv6 data packet is filtered out through data packet parsing and filtering;

[0016] Parse IPv6 data packets and filter out IPv6 fragmented data packets;

[0017] Parse IPv6 fragmented packets and filter out potential target packets.

[0018] As the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of the present invention, further, the key features of the data packet include: upper layer header type and fragment payload length.

[0019] As the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of the present invention, further, before matching the extracted key features of the data packet with the target threat features, it also includes:

[0020] Constructing a detection tree of IPv6 fragment bypass threat according to the final state of IPv6 fragment bypass threat behavior, wherein each node of the detection tree represents a detection feature, and a leaf node of the detection tree represents the final state of threat detection, and the final state of threat detection is divided into threat type or non-threat type;

[0021] The threat feature detection path of the IPv6 fragment bypass threat is obtained based on the leaf nodes of the detection tree and threat type, and the target threat feature is composed of the threat detection path.

[0022] As the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of the present invention, further, the extracted key features are matched with the target threat features, including:

[0023] Determine whether the upper layer header type of the data packet belongs to a specified type according to the key features, wherein the specified type includes: TCP type or ICMPv6 / UDP type;

[0024] If the upper layer header type of the data packet belongs to the specified type, then determine whether the packet fragment payload length is within the corresponding payload range. If it is within the payload range, then determine that the packet header is complete and the packet is a secure packet. If it is not within the payload range, then determine that the packet header is incomplete and the packet has an IPv6 fragment bypass threat.

[0025] If the upper layer header type of the data packet does not belong to the specified type, the upper layer header type of the data packet is determined to be an unknown type, and the data packet is at risk of IPv6 fragment bypass.

[0026] On the other hand, the present invention also provides an IPv6 fragmentation bypass threat detection system based on eBPF and XDP, comprising: a setting module and a detection module, wherein:

[0027] A setting module, used to set a data packet observation point in the network driver layer, wherein the data packet observation point is used to mount the extended Berkeley packet filter eBPF program on the data packet processing path using the fast data path XDP technology;

[0028] The detection module is used to call the eBPF program on the XDP network hook using the data packet observation point for the data packets received on the network driver layer, and identify and filter the data packets with potential threats using the feature matching strategy through the eBPF program. The feature matching strategy is used to extract the key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packet is complete.

[0029] Beneficial effects of the present invention:

[0030] The present invention combines the dynamic programmability of eBPF and the high-performance packet processing capability of XDP to achieve efficient detection of IPv6 fragmentation bypass threats. Specifically, XDP technology is used to filter IPv6 packets in real time at the network driver layer to ensure that threat packets can be identified and processed at the earliest stage; eBPF programs are written to parse filtered IPv6 packets, and the integrity of the upper-layer header is detected based on feature matching to identify and detect IPv6 fragmentation bypass threats; in the threat identification process, key threat features are extracted and feature matching is performed in the packet parsing stage, and corresponding instructions are executed according to the results of feature matching to achieve efficient threat detection. Further experimental results show that the proposed solution can successfully detect all 16 IPv6 fragmentation bypass threats of the Frag6-TestSuite tool, with a detection rate of nearly 99.98% under different threat intensities, which is better than the existing Baseline and Suricata solutions. In terms of threat processing delay, the proposed solution is 99.96% less than the existing Baseline solution and about 8% less than the Suricata solution. At the same time, the CPU utilization is reduced by 95.03% and 85.77% respectively. In addition, the proposed solution has little impact on network performance, and the packet loss rate is always 0, which meets the task requirements of high-performance solutions for IPv6 network security threats. Even under severe threats, the impact on system stability is small, and it has good application prospects in the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is an illustration of an IPv6 fragmentation bypass threat case in the embodiment;

[0032] Figure 2 It is a schematic diagram of the classification framework of IPv6 fragment bypass threats in the embodiment;

[0033] Figure 3 This is a schematic diagram of the IPv6 fragmentation bypass threat detection process based on eBPF and XDP in the embodiment;

[0034] Figure 4 This is a schematic diagram of the architecture of FragEva6-Guard, an IPv6 fragmentation bypass threat detection solution tool based on eBPF and XDP in the embodiment;

[0035] Figure 5 This is a schematic diagram of the XDP workflow in the embodiment;

[0036] Figure 6 This is a schematic diagram of the IPv6 fragment bypass threat detection tree in the embodiment;

[0037] Figure 7 This is a schematic diagram of the experimental environment topology in the embodiment;

[0038] Figure 8 This is a comparative illustration of IPv6 fragment bypass threat type identification in the embodiment;

[0039] Fig. 9 It is a comparison diagram of threat detection rates at different packet sending rates in the embodiment;

[0040] Fig.10 It is a comparison diagram of threat processing delays at different packet sending rates in the embodiment;

[0041] Fig.11 The figure is a comparison diagram of CPU usage at different packet sending rates in the embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0043] The IPv6 fragment header can be maliciously used by threat actors to bypass firewalls and other security protection systems, posing an IPv6 fragment bypass threat. Figure 1As shown in the figure, the firewall is configured to prevent any host from sending ICMPv6 echo request (EchoRequest) packets to host B. Normally, the ICMPv6 echo request in the first fragment sent by host A is correctly identified and discarded by the firewall, as shown in packet 1, but the threat actor bypasses the firewall's detection by placing the ICMPv6 header in the second fragment, as shown in packet 2. The threat actor uses the IPv6 fragment header mechanism to split the IPv6 header chain into multiple fragments, thereby hiding key information of the upper-layer protocol, such as ICMPv6 header information. Since most security protection systems mainly check the upper-layer protocol fields in the first fragment, the threat actor can hide malicious data in subsequent fragments to avoid detection by the protection system.

[0044] IPv6 fragment bypass threats are classified based on three dimensions: IPv6 fragment length, other IPv6 extension header utilization, and whether the upper layer header protocol appears. The classification framework of IPv6 fragment bypass threats is as follows: Figure 2 As shown in the figure. These three classification dimensions are all indispensable features of IPv6 fragment bypass threats. IPv6 fragment packets can be divided into two categories according to the fragment length: tiny fragments and normal fragments; since IPv6 fragment bypass threats must be based on the combination of IPv6 extension headers, they can be divided into multiple categories according to the way different extension headers are exploited, namely, destination option header exploitation, overlapping fragment vulnerability exploitation, and a large number of extension headers of the same type and different types; IPv6 is a network layer protocol, and its function is to carry upper layer headers (such as Transmission Control Protocol TCP) and payload data. Therefore, an IPv6 fragment packet can be classified according to whether the upper layer header type appears.

[0045] These three classification dimensions are independent of each other and can be combined with each other. For example, any threat fragmented data packet may use normal fragments to construct an IPv6 fragment bypass threat, or it may use tiny fragments and maliciously hide the protocol type of the upper-layer header. Therefore, in order to systematically explore the diversity of IPv6 fragment bypass threats, the above classifications are freely combined to obtain a total of 16 test cases, thereby constructing an IPv6 fragment bypass threat test suite (Frag6-TestSuite) for testing.

[0046] Currently, there is a lack of effective detection tools for IPv6 fragmentation bypass threats, and existing IPv6 threat detection methods mainly focus on local signals in threat behaviors, often with the limitation of insufficient generalization ability. This allows threat actors to bypass existing protection by constructing variant threats, resulting in missed reports. For example, in Figure 2In the combined threat shown, the threat behavior is manifested as a pattern of "tiny fragments → D → known upper layer protocol type → S". Traditional detection methods usually rely on local signals D or tiny fragment features in the threat steps for identification. However, this method is easily bypassed by other behaviors such as "normal fragments → A → known upper layer protocol type → S" or "normal fragments → B → known upper layer protocol type → S", resulting in detection failure.

[0047] Most existing IPv6 threat detection solutions rely on user space processing, which often causes performance bottlenecks in high-speed network environments. In addition, IPv6 security vulnerabilities are mostly caused by processing defects in the kernel protocol stack. Threat actors can trigger kernel exceptions in the target system through carefully constructed abnormal data packets, thereby achieving their threat objectives. Therefore, how to intercept and process threat data packets before they reach the kernel protocol stack has become a key issue in ensuring high-performance detection.

[0048] To this end, an embodiment of the present invention provides an IPv6 fragment bypass threat detection method based on eBPF and XDP, such as Figure 3 As shown, including:

[0049] S101, setting a data packet observation point at the network driver layer, wherein the data packet observation point is used to mount the extended Berkeley packet filter eBPF program on the data packet processing path by using the fast data path XDP technology;

[0050] S102. For the data packets received on the network driver layer, the eBPF program on the XDP network hook is called using the data packet observation point. The eBPF program uses the feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packet is complete.

[0051] Shift the focus of detection from a single intermediate signal to the final state S of the threat behavior. By analyzing the changes in system state caused by threats, IPv6 upper-layer header integrity detection is used to implement IPv6 fragmentation bypass threat detection to more effectively deal with threat variants. Introduce eBPF and XDP technologies. eBPF is an efficient virtual machine embedded in the Linux kernel that allows custom programs to be dynamically loaded to perform operations such as packet filtering. As a high-performance packet processing framework based on eBPF, XDP can process received packets at the earliest stage of the network stack, that is, the network card driver layer, thereby achieving extremely low processing latency.

[0052] like Figure 4As shown in the figure, the architecture of the detection tool FragEva6-Guard constructed by this solution is mainly composed of five core components: packet filtering, feature parsing, threat feature extraction, upper-layer header integrity detection based on feature matching, and XDP processing decision.

[0053] XDP workflow Figure 5 As shown in the figure, the XDP program can directly perform operations at the NIC driver layer, such as dropping (XDP_DROP), passing (XDP_PASS), or redirecting (XDP_REDIRECT). This design greatly improves the efficiency of packet processing while reducing the system load. In particular, the drop function of XDP can intercept and discard abnormal packets before they reach the kernel protocol stack. This not only ensures high-performance detection, but also effectively prevents potential threats from triggering kernel-level vulnerabilities.

[0054] The entire architecture of the detection tool in this case is implemented based on eBPF and XDP technology, and all processing processes are completed before the IPv6 data packet reaches the kernel protocol stack. Specifically, first, the packet filtering module is responsible for screening out potential target data packets; then, the feature parsing module performs detailed parsing of the IPv6 header field to obtain its key field information; then, the threat feature extraction module extracts key features related to the threat from the parsed data for subsequent detection; in the feature matching stage, the system performs matching analysis based on the extracted features to determine whether the upper layer header is complete. If the feature match is successful, it means that the data packet has a threat and enters the next step of processing; if it does not match, it is judged to be safe; finally, according to the matching results, the XDP processing decision module executes the corresponding instructions: for data packets identified as threats, the system will discard the packet through the XDP_DROP instruction; and for safe data packets, the system will return the XDP_PASS instruction to allow it to enter the network protocol stack, thereby ensuring that it will not affect the normal network service functions.

[0055] In the eBPF program, two address variables can be used to point to the starting address and ending address of the Ethernet data frame received by the network driver layer, and the address variable data type can be converted into a pointer to extract the IP layer data message and the TCP / UDP layer data message through the address variable.

[0056] Specifically, the eBPF program uses a feature matching strategy to identify and filter packets with potential threats, which can be designed to include:

[0057] Parsing data packets layer by layer starting from the Ethernet data frame, and filtering out potential target data packets from the IPv6 data packets, wherein the potential target data packet is the first fragmented data packet in the IPv6 fragmented data packets;

[0058] Parse the header fields of potential target data packets and obtain key fields in the extended header of the data packet; extract key features related to the threat from the key fields of the data packet header; match the extracted key features with the target threat features;

[0059] If the match is successful, the potential target data packet is determined to be a threat and a packet drop operation is performed. Otherwise, the potential target data packet is determined to be a safe data packet and an operation of allowing the data packet to enter the network protocol stack is performed.

[0060] Before matching the extracted key features of the data packet with the target threat features, the target threat features can be obtained through the following steps:

[0061] Constructing a detection tree of IPv6 fragment bypass threat according to the final state of IPv6 fragment bypass threat behavior, wherein each node of the detection tree represents a detection feature, and a leaf node of the detection tree represents the final state of threat detection, and the final state of threat detection is divided into threat type or non-threat type;

[0062] The threat feature detection path of the IPv6 fragment bypass threat is obtained based on the leaf nodes of the detection tree and threat type, and the target threat feature is composed of the threat detection path.

[0063] Can be used as Figure 6 The IPv6 fragment bypass threat detection tree shown below identifies the main features of the threat. Each node of the tree is a detection feature, and the leaf nodes of the tree refer to the final detection status, which has only two categories: threat or non-threat.

[0064] in:

[0065] T: Indicates threat, the IPv6 upper layer header is incomplete.

[0066] A: Indicates the first fragment. The offset field value of the IPv6 fragment header is 0.

[0067] B: Indicates that more fragments are contained. The value of the More Fragments field in the IPv6 Fragment header is 1.

[0068] C: Indicates that the upper-layer header type is obtained, that is, the next header field value (Last_nh) of the last extended header is equal to the protocol type of the common upper-layer header.

[0069] D: Indicates that the TCP header is complete, that is, the payload length of the first fragment data packet is greater than or equal to 20 bytes.

[0070] E: Indicates that the ICMPv6 (Internet Control Message Protocol version 6) or UDP (User Datagram Protocol) header is complete, that is, the payload length of the first fragment data packet is greater than or equal to 8 bytes.

[0071] Depend on Figure 6 It can be seen that there are three paths to detect threat T, namely: These three paths are abstracted into three feature expressions. Each feature detects a special type of threat. All features check all IPv6 fragment header bypass threats. The combined detection logic expression is:

[0072]

[0073] The combination of A and B indicates that the current fragmented data packet is the first fragment. If there is no restriction on condition B, an atomic fragmented data packet may be obtained, which cannot pose a fragment bypass threat, so it is necessary to filter out such situations. Therefore, three features can be extracted:

[0074] Feature 1:

[0075] The threat actor can construct IPv6 fragments of known or unknown upper layer protocols to bypass the threat by specifying the Next Header field of the last extension header of the first fragment packet.

[0076] When C is true, it indicates that the upper layer protocol type is known. For example, when Last_nh=6, the upper layer protocol is TCP. When C is false, it indicates that the upper layer protocol type is unknown. For example, Last_nh=60 indicates that the next header is the destination option header, but the actual upper layer protocol type is unknown.

[0077] Since Last_nh is the next header value of the last extended header of the first fragment, when Last_nh=60, it means that the next destination option extended header must appear in the second fragment. It can be inferred that the real upper-layer protocol header must be in the subsequent fragments, and it is determined that an IPv6 fragment bypass threat has occurred.

[0078] Feature 2:

[0079] From feature 1, we can see that when C is true, it means the upper layer protocol type is known. Common upper layer protocol types are 6 (TCP), 17 (UDP), and 58 (ICMPv6). Since the length of ICMPv6, UDP, and other headers is 8 bytes, when E is false, it means that the upper layer protocol header is incomplete when it is ICMPv6 or UDP, and it is determined that an IPv6 fragmentation bypass threat has occurred.

[0080] Feature 3:

[0081] C is true, indicating that the upper-layer protocol type is known, which is similar to feature 2, except that feature 3 targets the TCP protocol header type. The key information of TCP is stored in the first 20 bytes, so when D is false, it means that the TCP header is incomplete, and it is determined that an IPv6 fragmentation bypass threat has occurred.

[0082] Specifically, the extracted key features are matched with the target threat features, which can be designed to include:

[0083] Determine whether the upper layer header type of the data packet belongs to a specified type according to the key features, wherein the specified type includes: TCP type or ICMPv6 / UDP type;

[0084] If the upper layer header type of the data packet belongs to the specified type, then determine whether the packet fragment payload length is within the corresponding payload range. If it is within the payload range, then determine that the packet header is complete and the packet is a secure packet. If it is not within the payload range, then determine that the packet header is incomplete and the packet has an IPv6 fragment bypass threat.

[0085] If the upper layer header type of the data packet does not belong to the specified type, the upper layer header type of the data packet is determined to be an unknown type, and the data packet is at risk of IPv6 fragment bypass.

[0086] The following code listing shows a simple XDP program framework. Its core function is to parse the extension header in the IPv6 data packet and make judgments based on the integrity of the header chain:

[0087]

[0088]

[0089] The execution environment of the eBPF program running through XDP technology depends on the xdp_md parameter passed by the kernel. Among the members of this structure, the data and data_end variables point to the start address and end address of the Ethernet frame received from the device driver layer, respectively. With the help of these two variables, the structure representing the IP layer message and the structure representing the TCP / UDP layer message in the Linux kernel network stack can be extracted. Although data and data_end store memory addresses, their data types in C language are still 32-bit unsigned integers. After converting their types to pointers, the storage data pointed to by these addresses can be obtained. The program can parse the IPv6 data packet and IPv6 fragment header information layer by layer, starting from the Ethernet frame.

[0090] Specifically, the program can traverse and parse the IPv6 extension header until the upper layer protocol is found or a parsing error is encountered. The key features and functions of the code can be described as follows:

[0091] The program uses the ctx->data and ctx->data_end pointers to define packet boundaries and ensure safe and direct access to packet data. This is a fundamental aspect of XDP programming and allows efficient inspection of packets without compromising memory safety.

[0092] IPv6 packet filtering is implemented, demonstrating XDP's ability to perform specific protocol filtering at the earliest stage of the network stack. This feature is critical for optimizing network performance by quickly discarding irrelevant traffic.

[0093] The program contains logic to identify and process the first fragment in an IPv6 fragmented packet. This capability is critical to defending against fragmentation-based threats and ensuring proper reassembly of fragmented packets.

[0094] The ability to implement header chain integrity checks demonstrates XDP’s ability to perform deep packet inspection and validate complex protocol structures. This feature is critical for detecting malformed packets that could exploit network stack vulnerabilities.

[0095] Use XDP_DROP to demonstrate XDP's ability to immediately reject packets, a key feature for implementing efficient firewall functionality directly in the kernel.

[0096] The structure of the program allows for easy extension to handle additional IPv6 extension headers, highlighting the flexibility of XDP in adapting to complex protocol scenarios.

[0097] Although the code is a framework implementation, it demonstrates the core advantage of XDP: it can efficiently process and filter data packets before they enter the protocol stack, thereby providing high-performance threat detection capabilities. By further extending the framework, more types of extension headers can be parsed or other security policies can be added to deal with complex network threats.

[0098] It is important to emphasize that for eBPF programs running in the kernel, the eBPF verifier is used to strictly perform memory boundary checks. To prevent out-of-bounds errors, the program must perform boundary checks when parsing each layer of the protocol. In other words, all eBPF programs that can successfully run in the kernel have been strictly reviewed by the verifier, so they have a high degree of security.

[0099] Further, based on the above method, an embodiment of the present invention also provides an IPv6 fragmentation bypass threat detection system based on eBPF and XDP, comprising: a setting module and a detection module, wherein:

[0100] A setting module, used to set a data packet observation point in the network driver layer, wherein the data packet observation point is used to mount the extended Berkeley packet filter eBPF program on the data packet processing path using the fast data path XDP technology;

[0101] The detection module is used to call the eBPF program on the XDP network hook using the data packet observation point for the data packets received on the network driver layer, and identify and filter the data packets with potential threats using the feature matching strategy through the eBPF program. The feature matching strategy is used to extract the key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packet is complete.

[0102] In order to verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0103] FragEva6-Guard is implemented in C language using eBPF and XDP technologies. The C code is then converted into eBPF bytecode using the LLVM / Clang compiler tool chain. Finally, the eBPF bytecode is loaded into the kernel for execution.

[0104] like Figure 7 In the experimental environment shown, hosts A and B are equipped with AMD Ryzen 9 5900HX CPU, with a main frequency of 3.30GHz and a memory of 8GB. Host A is installed with Ubuntu 23.04 operating system, with a kernel version of Linux 6.2, and host B is installed with Ubuntu 20.10 operating system, with a kernel version of Linux 5.8.

[0105] Comparison method: Host A calls Frag6-TestSuite as the main test tool, sends threat messages, and constantly adjusts the packet sending rate to simulate different threat intensities. In order to verify the effectiveness and advantages of this solution, the integrity detection of the upper layer IPv6 header based on feature matching is implemented in three different scenarios. First, a baseline model is manually implemented based on Python. The model uses the NFQUEUE hook mechanism of Netfilter to filter and parse IPv6 packets in the network protocol stack to identify and defend against potential threats. Secondly, the open source IDS Suricata v7.0.6, which currently supports IPv6 most comprehensively, is improved, mainly including improving the parsing module of the IPv6 packet extension header, adding specific rules to detect IPv6 fragment bypass threats, etc. The specific modifications involve files such as decode-ipv6.c, decode-events.h, decode-events.c and defrag.c, and corresponding rules are added in suricata.rules. Finally, this solution is implemented based on XDP. Subsequent experiments will mainly focus on comparative analysis of the FragEva6-Guard method in this case with the baseline method and the improved Suricata.

[0106] 1. Effectiveness

[0107] The 16 preset IPv6 fragment bypass threat types were used to test FragEva6-Guard, Snortv3.1.61.0, Suricata v6.0.12, ofsoftswitch, DoTExtHdr and NOPO. The results are as follows: Figure 8 shown.

[0108] Among them, Snort v3.1.61.0 and Suricata v6.0.12 are the two latest versions of open source IDS with high support for IPv6. ofsoftswitch, DoTExtHdr and NOPO are three detection or protection solutions proposed for certain threats of IPv6 extension headers.

[0109] According to the experimental results, although Snort v3.1.61.0 and Suricata v6.0.12 also identified 8 types of threats, they mainly focused on the IPv6 fragment bypass threat when the fragmented data packet contains multiple extension headers of the same or different types, and failed to cover the IPv6 fragment bypass threat when the fragmented data packet contains overlapping fragments or no more than two destination option headers.

[0110] Ofsoftswitch can identify 2 types of threats, DoTExtHdr can identify 10 types of IPv6 fragment bypass threats, which is attributed to its main identification of two threats: tiny fragments and overlapping fragments. NOPO is better than other solutions and can identify 12 types of threats.

[0111] Since most of these solutions are aimed at identifying certain types of specific threats to IPv6 extension headers, such as tiny fragments, overlapping fragments, etc., these security solutions cannot cover all types of IPv6 fragment bypass threats.

[0112] FragEva6-Guard demonstrates the most comprehensive IPv6 fragment bypass threat identification capability, and can identify all 16 threat scenarios. This is because FragEva6-Guard does not identify a few specific threats, but focuses on the final state of IPv6 fragment bypass threats (i.e., IPv6 upper layer header integrity detection).

[0113] 2. Detection performance

[0114] Using a set of comparative experiments, host A generates and sends threat packets through Frag6-TestSuite, gradually increasing the packet sending rate to simulate threat scenarios of different intensities. In each round of experiments, 100,000 threat packets are sent, and the average length of each packet is 624 bytes. The threat detection rate and threat processing delay of Baseline, Suricata and FragEva6-Guard under different threat intensities are measured respectively. The experimental results are shown in the figure. Fig. 9 and Fig.10 shown.

[0115] Fig. 9The threat detection rates of three different methods are shown. As the threat intensity increases, the detection rate of the Baseline method drops significantly, especially when the traffic reaches 28k packets per second (pps), only 25.70% of the threat packets can be detected. This inefficient performance is mainly attributed to the fact that the Baseline is implemented in Python and relies on Netfilter hooks, which show obvious performance bottlenecks under high-intensity threats. In contrast, Suricata performs well when the threat traffic does not exceed 20k pps. However, at traffic above 22k pps, Suricata's detection rate begins to decline. This result is in line with expectations, because although Suricata is the most complete open source IDS with IPv6 support and is highly maintained, its architecture still faces bottlenecks under high-traffic conditions. In contrast, FragEva6-Guard maintains a detection rate close to 100% under almost all threat intensities, and even at the highest threat intensity (28000 pps), the detection rate remains at around 99%, demonstrating excellent stability and reliability. This is due to the fact that FragEva6-Guard is implemented based on eBPF and XDP. The XDP hook intervenes in the packet processing flow earlier than Netfilter, and is implemented in C language running in the kernel, which significantly improves the system's processing performance.

[0116] Fig.10 The threat processing delays of the three methods are shown. The results show that the delay of the Baseline method fluctuates greatly and is significantly higher than the other two methods. This indicates that it has a significant performance bottleneck when processing high-intensity threats. Suricata's delay performance under medium and low-intensity threats is relatively stable, especially when the traffic is less than 22k pps, its processing delay is almost the same as FragEva6-Guard. However, as the threat traffic exceeds 22k pps, Suricata's processing delay increases. In sharp contrast, FragEva6-Guard shows the lowest threat processing delay under all threat intensities, and as the threat intensity increases, the threat processing delay shows a continuous downward trend. In theory, an excellent packet processing solution should reduce packet processing delay as the packet rate increases (in other words, the processing rate will also increase). The experimental results show that FragEva6-Guard meets this requirement.

[0117] 3. Network influence

[0118] In order to evaluate the impact of FragEva6-Guard on actual network performance, a series of comparative experiments were designed and implemented. Specifically, the experiment used the Frag6-TestSuite tool on host A to generate and send threat traffic of different intensities, and gradually increased the packet rate to simulate a variety of threat scenarios. Each round of experiments continuously sent packets of 624 bytes in length within a fixed period of time to ensure the stability and repeatability of the test scenario. Three different detection methods, Baseline, Suricata and FragEva6-Guard, were deployed on host B to measure their impact on network performance. The performance indicators mainly measured RTT and packet loss rate by sending ICMP echo requests to host B from a third host and receiving echo replies. The experimental results are shown in Table 1.

[0119] Table 1 Impact of different solutions on network performance

[0120]

[0121] The experimental results clearly show the impact of the three different detection methods on network performance as the threat intensity increases. First, the Baseline performs well at low threat intensity, but as the packet rate increases, the RTT increases significantly, and the packet loss rate gradually increases above 8k pps, reaching 100% at 20k pps. This phenomenon can be attributed to the design limitations of the Baseline. Since it is based on Netfilter hooks and implemented in Python, its performance bottleneck gradually emerges when dealing with high-traffic, high-intensity threats.

[0122] In contrast, Suricata performs relatively stably under low and medium threat intensities. When the packet rate is less than 20k pps, its RTT is maintained between 0.4-0.9ms, and the packet loss rate is almost 0. However, as the threat intensity exceeds 20k pps, Suricata's performance begins to decline significantly, with the RTT rising to more than 0.45ms and the packet loss rate reaching 25%. Although Suricata is the most mature open source IDS and has good IPv6 support capabilities, it still cannot avoid delays and packet loss in high-intensity threat environments.

[0123] Finally, FragEva6-Guard performed well in all test scenarios. When the threat intensity gradually increased to 30kpps, its RTT remained between 0.3-0.7ms and the packet loss rate was always 0. Its kernel-level data processing capability can quickly capture and parse IPv6 fragment headers, while performing efficient filtering and forwarding, avoiding the overhead of switching between user mode and kernel mode, thus maintaining low latency and zero packet loss rate under high threat intensity.

[0124] 4. Resource Overhead

[0125] In order to comprehensively evaluate the resource overhead of FragEva6-Guard, a set of comparative experiments was designed, and the settings were similar to the previous network performance test. The main difference is that this experiment focuses on measuring the CPU and memory usage of host B under different threat intensities when deploying Baseline, Suricata, and FragEva6-Guard. To ensure the accuracy of the data, the top tool is used for monitoring and recording. The CPU utilization results of the experiment are shown in the figure below. Fig.11 It should be noted that, because the experimental environment uses a multi-core CPU, the CPU utilization may exceed 100%, which reflects the situation that multiple cores process tasks in parallel, rather than the phenomenon of a single core being overloaded.

[0126] From the experimental results, we can see that the CPU utilization of the Baseline method under all threat intensities always remains between 101% and 104%. Combined with the aforementioned experiments on performance evaluation and network impact, this high CPU utilization indicates that the Baseline method may have approached its performance bottleneck when processing network packets. As the threat intensity increases, the Baseline has difficulty effectively processing higher-intensity threat traffic and shows obvious signs of resource exhaustion.

[0127] In contrast, FragEva6-Guard performs well in terms of resource utilization efficiency. Experimental data shows that under low-intensity threats (2k-8k pps), FragEva6-Guard's CPU utilization always remains below 1%, which is much lower than the resource consumption of Baseline and Suricata. Even under the highest threat intensity (28k pps), its CPU utilization only rises to 10.78%, which is significantly better than Suricata and Baseline, fully demonstrating FragEva6-Guard's significant advantage in efficient use of system resources.

[0128] In terms of memory usage, the experimental results show that the memory usage of the three detection methods is small and does not change significantly under different threat intensities. Therefore, the memory usage is not included in further analysis or graphic display.

[0129] 5. Scalability

[0130] In order to evaluate the scalability of FragEva6-Guard, we conducted an in-depth analysis of its ability to respond to and detect new network threats, and conducted an empirical study using the recently disclosed CVE-2024-38063 vulnerability as an example. CVE-2024-38063 is a high-risk Windows TCP / IP vulnerability with a CVSS (Common Vulnerability Scoring System) score of 9.8. The root cause is a defect in the implementation of the target host IPv6 protocol stack. Specifically, when the protocol stack processes certain types of abnormal IPv6 packets, especially packets containing incorrect destination options extension headers, it may trigger a buffer overflow, leading to a serious risk of remote code execution.

[0131] FragEva6-Guard's modular architecture enables it to be flexibly expanded to deal with such emerging threats. In this experiment, in response to the CVE-2024-38063 vulnerability, the detection logic of the destination option extension header was added to its packet parsing module. When unknown or abnormal types of options are detected, the system can immediately discard the corresponding data packets to avoid potential threats.

[0132] In order to verify the protection effect of FragEva6-Guard against the CVE-2024-38063 vulnerability, a set of experiments was designed to simulate the threat actor to make multiple attempts by increasing the success rate of vulnerability exploitation, and send multiple threat data packets each time. The experiment covers different threat intensities (the number of attempts ranges from 20 to 40, and the number of packets sent each time ranges from 20 to 50). The results are shown in Table 2. FragEva6-Guard achieved a 100% detection rate under all test conditions and successfully identified and intercepted all simulated threat packets (the total number of packets ranged from 400 to 2000).

[0133] Table 2 Detection results for CVE-2024-38063 vulnerability

[0134]

[0135] It is worth emphasizing that FragEva6-Guard's XDP-based implementation can process data packets before they enter the kernel, which greatly enhances the robustness of the system and avoids potential system crashes caused by abnormal IPv6 packets. By implementing early interception at the driver level, FragEva6-Guard can not only effectively defend against known threats, but also provide an additional layer of protection for the system to prevent the exploitation of unknown protocol stack vulnerabilities.

[0136] The above experiments show that this solution can be used as a high-performance solution for IPv6 network security threats. Even under severe threats, it has little impact on system stability and has good application prospects in the field of network security detection.

[0137] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0138] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0139] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0140] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0141] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for detecting IPv6 fragmentation bypass threats based on eBPF and XDP, characterized in that: Include: Setting a data packet observation point at the network driver layer, wherein the data packet observation point is used to mount the extended Berkeley packet filter eBPF program on the data packet processing path using the fast data path XDP technology; For the data packets received on the network driver layer, the eBPF program on the XDP network hook is called using the data packet observation point. The eBPF program uses the feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract the key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packet is complete.

2. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1, characterized in that: In the eBPF program, two address variables are used to point to the starting address and ending address of the Ethernet data frame received by the network driver layer, and the address variable data type is converted into a pointer to extract the IP layer data message and the TCP / UDP layer data message through the address variable.

3. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1 or 2, characterized in that: The eBPF program uses feature matching strategies to identify and filter packets with potential threats, including: Parsing data packets layer by layer starting from the Ethernet data frame, and filtering out potential target data packets from the IPv6 data packets, wherein the potential target data packet is the first fragmented data packet in the IPv6 fragmented data packets; Parse the header fields of potential target data packets and obtain key fields in the extended header of the data packet; extract key features related to the threat from the key fields of the data packet header; match the extracted key features with the target threat features; If the match is successful, the potential target data packet is determined to be a threat and a packet drop operation is performed. Otherwise, the potential target data packet is determined to be a safe data packet and an operation of allowing the data packet to enter the network protocol stack is performed.

4. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 3 is characterized in that: Parse the data packets layer by layer starting from the Ethernet data frame, and filter out potential target data packets from the IPv6 data packets, including: Starting from the Ethernet data frame, the IPv6 data packet is filtered out through data packet parsing and filtering; Parse IPv6 data packets and filter out IPv6 fragmented data packets; Parse IPv6 fragmented packets and filter out potential target packets.

5. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1, characterized in that: The key characteristics of the data packet include: upper layer header type and fragment payload length.

6. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1, characterized in that: Before matching the extracted key features of the data packet with the target threat features, it also includes: Constructing a detection tree of IPv6 fragment bypass threat according to the final state of IPv6 fragment bypass threat behavior, wherein each node of the detection tree represents a detection feature, and a leaf node of the detection tree represents the final state of threat detection, and the final state of threat detection is divided into threat type or non-threat type; The threat feature detection path of the IPv6 fragment bypass threat is obtained based on the leaf nodes of the detection tree and threat type, and the target threat feature is composed of the threat detection path.

7. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1, characterized in that: Match the extracted key features with the target threat features, including: Determine whether the upper layer header type of the data packet belongs to a specified type according to the key features, wherein the specified type includes: TCP type or ICMPv6 / UDP type; If the upper layer header type of the data packet belongs to the specified type, then determine whether the packet fragment payload length is within the corresponding payload range. If it is within the payload range, then determine that the packet header is complete and the packet is a secure packet. If it is not within the payload range, then determine that the packet header is incomplete and the packet has an IPv6 fragment bypass threat. If the upper layer header type of the data packet does not belong to the specified type, the upper layer header type of the data packet is determined to be an unknown type, and the data packet is at risk of IPv6 fragment bypass.

8. An IPv6 fragmentation bypass threat detection system based on eBPF and XDP, characterized in that: Contains: setting module and detection module, among which, A setting module, used to set a data packet observation point in the network driver layer, wherein the data packet observation point is used to mount the extended Berkeley packet filter eBPF program on the data packet processing path using the fast data path XDP technology; The detection module is used to call the eBPF program on the XDP network hook using the data packet observation point for the data packets received on the network driver layer, and identify and filter the data packets with potential threats using the feature matching strategy through the eBPF program. The feature matching strategy is used to extract the key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packet is complete.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images