Ebpf and xdp based ipv6 fragmentation bypass threat detection method and system

Abstract

The application relates to the technical field of network security, in particular to an IPv6 fragmentation bypass threat detection method and system based on eBPF and XDP, which sets a data packet observation point at a network driver layer, the data packet observation point is used for mounting an extended Berkeley packet filter (eBPF) program on a data packet processing path by using a fast data path (XDP) technology; for a data packet received on the network driver layer, the data packet observation point calls the eBPF program on an XDP network hook, the eBPF program is used for identifying and filtering a data packet with potential threats by using a feature matching strategy, the feature matching strategy is used for extracting key features of the data packet, matching the extracted key features of the data packet with target threat features, and judging whether an upper layer header of the data packet is complete; the application realizes efficient detection of specific threats by combining the dynamic programmability of the eBPF and the high-performance data packet processing capability of the XDP, meets the task requirements of an IPv6 network security threat high-performance solution, and has a smaller influence on system stability even under serious threats.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for detecting IPv6 fragmentation bypass threats based on eBPF and XDP. Background Technology

[0002] With the increasing global deployment and application of IPv6, security threats and incidents in IPv6 networks are also increasing, particularly regarding security issues related to IPv6 extension headers. While IPv6 extension headers bring greater flexibility and scalability to the protocol, they also introduce many new security problems. For example, the complexity of IPv6 extension headers makes operating systems vulnerable to vulnerabilities when processing abnormal data packets, leading to serious risks such as remote code execution or denial-of-service (DoS) threats.

[0003] The IPv6 fragmentation header is one of the IPv6 extension headers responsible for enabling packet fragmentation. However, its complexity also provides opportunities for threat actors to exploit. Over the years, researchers have discovered various security vulnerabilities based on the IPv6 fragmentation header, such as fragment overlap and atomic fragmentation. These vulnerabilities can lead to IPv6 fragmentation bypass threats, which can cause DoS attacks, intrusion detection systems (IDS), and firewalls to fail. This type of security system bypass threat refers to attackers using the IPv6 fragmentation header mechanism to construct specially designed IPv6 packets, allowing packets that should be rejected by security systems to pass through detection and be received by the target system.

[0004] To address the IPv6 fragmentation bypass threat, RFC 7112 (Request for Comments) proposes that when a host fragments an IPv6 packet, the first fragment must contain complete upper-layer protocol information. If an IPv6 host receives a packet that does not meet this requirement, it should discard the packet and send an ICMPv6 error message. However, as a theoretical solution to the IPv6 fragmentation bypass threat, existing research indicates that not all network devices and operating systems fully comply with RFC 7112. Although RFC 7112 is proposed as a theoretical solution to the IPv6 fragmentation bypass threat, it has not been widely implemented in current protection systems and devices. Currently, there is a lack of a universal solution capable of proactively detecting IPv6 fragmentation bypass threats. Furthermore, while some research has shown the ability to detect specific types of IPv6 threats, these methods are often limited to specific application scenarios and lack sufficient scalability. Moreover, most existing solutions are user-space based, resulting in high performance overhead in large-scale traffic environments, failing to meet the needs of practical deployments. Summary of the Invention

[0005] To address this, the present invention provides a method and system for detecting IPv6 fragmentation bypass threats based on eBPF and XDP, which solves the problems of limited identification types and poor detection performance in existing IPv6 fragmentation bypass threat detection technologies.

[0006] According to the design scheme provided by this invention, on one hand, a method for detecting IPv6 fragmentation bypass threats based on eBPF and XDP is provided, comprising:

[0007] A packet observation point is set in the network driver layer. The packet observation point is used to mount the Extended Berkeley Packet Filter (eBPF) program on the packet processing path using the Fast Data Path (XDP) technology.

[0008] For data packets received at the network driver layer, the eBPF program on the XDP network hook is invoked using the data packet observation point. The eBPF program uses a feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packets is complete.

[0009] As part of the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of this invention, the eBPF program further utilizes two address variables to point to the start address and end address of the Ethernet data frame received by the network driver layer, respectively, and converts the data type of the address variables to pointers, so as to extract IP layer data packets and TCP / UDP layer data packets through the address variables.

[0010] As part of the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of this invention, the method further includes identifying and filtering potentially threatening data packets using a feature matching strategy through an eBPF program, comprising:

[0011] The data packets are parsed layer by layer starting from the Ethernet data frame, and potential target data packets are filtered out from the IPv6 data packets. The potential target data packet is the first fragment data packet in the IPv6 fragment data packet.

[0012] Parse the header fields of potential target data packets and obtain key fields from the extended header of the data packets; extract key threat-related features from the key fields of the data packet header; match the extracted key features with the target threat features;

[0013] If a match is found, the potential target data packet is determined to be a threat and a packet drop operation is performed; otherwise, the potential target data packet is determined to be a safe data packet and an operation is performed to allow the data packet to enter the network protocol stack.

[0014] As part of the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of this invention, further, it parses data packets layer by layer starting from Ethernet data frames and filters potential target data packets from IPv6 data packets, including:

[0015] Starting with Ethernet data frames, IPv6 packets are extracted through packet parsing and filtering.

[0016] Parse IPv6 packets and filter out IPv6 fragmented packets;

[0017] Parse and filter IPv6 fragmented packets to identify potential target packets.

[0018] As part of the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of this invention, the key characteristics of the data packet further include: upper-layer header type and fragmentation payload length.

[0019] As part of the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of this invention, before matching the extracted key features of data packets with the target threat features, the method further includes:

[0020] An IPv6 fragmentation bypass threat detection tree is constructed based on the final state of the IPv6 fragmentation bypass threat behavior. Each node of the detection tree represents a detection feature, and the leaf nodes of the detection tree represent the final state of threat detection. The final state of threat detection is divided into threat type or non-threat type.

[0021] Based on the leaf nodes of the detection tree and threat type, the threat feature detection path of the IPv6 fragmentation bypass threat is obtained, and the target threat feature is composed of the threat detection path.

[0022] As part of the IPv6 fragmentation bypass threat detection method based on eBPF and XDP of this invention, the extracted key features are further matched with target threat features, including:

[0023] Based on key characteristics, determine whether the upper-layer header type of the data packet belongs to a specified type, which includes: TCP type or ICMPv6 / UDP type;

[0024] If the upper-layer header type of the data packet belongs to the specified type, it is determined whether the data packet fragment payload length is within the corresponding effective payload range. If it is within the effective payload range, it is determined that the data packet header is complete and the data packet is a secure data packet. If it is not within the effective payload range, it is determined that the data packet header is incomplete and the data packet has an IPv6 fragmentation bypass threat.

[0025] If the upper-layer header type of the data packet does not belong to the specified type, the upper-layer header type of the data packet is determined to be an unknown type, and the data packet has an IPv6 fragmentation bypass threat.

[0026] Furthermore, this invention also provides an IPv6 fragmentation bypass threat detection system based on eBPF and XDP, comprising: a setting module and a detection module, wherein,

[0027] The configuration module is used to set up packet observation points in the network driver layer. These packet observation points are used to mount the Extended Berkeley Packet Filter (eBPF) program onto the packet processing path using the Fast Data Path (XDP) technology.

[0028] The detection module is used to call the eBPF program on the XDP network hook for data packets received at the network driver layer. The eBPF program uses a feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packets is complete.

[0029] The beneficial effects of this invention are:

[0030] This invention combines the dynamic programmability of eBPF and the high-performance packet processing capabilities of XDP to achieve efficient detection of IPv6 fragmentation bypass threats. Specifically, XDP technology is used to filter IPv6 packets in real time at the network driver layer to ensure that threat packets are identified and processed at the earliest stage. An eBPF program is written to parse the filtered IPv6 packets and detect IPv6 fragmentation bypass threats by checking the integrity of the upper-layer header based on feature matching. During the threat identification process, key threat features are extracted and feature matching is performed during the packet parsing stage. Based on the result of feature matching, corresponding instructions are executed to achieve efficient threat detection. Furthermore, experimental results demonstrate that the proposed solution can successfully detect all 16 IPv6 fragmentation bypass threats using the Frag6-TestSuite tool, achieving a detection rate of nearly 99.98% under different threat intensities, outperforming existing Baseline and Suricata solutions. Regarding threat processing latency, the proposed solution reduces latency by 99.96% compared to the existing Baseline solution and by approximately 8% compared to the Suricata solution. Simultaneously, CPU utilization is reduced by 95.03% and 85.77%, respectively. Moreover, the proposed solution has minimal impact on network performance, with a consistently zero packet loss rate, meeting the requirements for a high-performance solution for IPv6 network security threats. Even under severe threats, the impact on system stability is minimal, demonstrating promising application prospects in the network security field. Attached image description:

[0031] Figure 1 This is an illustration of an IPv6 fragmentation bypass threat case in the example;

[0032] Figure 2 This is a schematic diagram of the classification framework for IPv6 fragmentation bypass threats in the embodiment;

[0033] Figure 3 This is a schematic diagram of the IPv6 fragmentation bypass threat detection process based on eBPF and XDP in the embodiment;

[0034] Figure 4 This is a schematic diagram of the FragEva6-Guard architecture, a threat detection scheme tool for IPv6 fragmentation bypass based on eBPF and XDP, as shown in the embodiment.

[0035] Figure 5 This is a schematic diagram of the XDP workflow in the embodiment;

[0036] Figure 6 This is a schematic diagram illustrating IPv6 fragmentation bypassing the threat detection tree in the embodiment;

[0037] Figure 7 This is a schematic diagram of the experimental environment topology in the embodiment;

[0038] Figure 8 This is a schematic diagram illustrating the identification and comparison of IPv6 fragmentation bypass threat types in the embodiment;

[0039] Figure 9 This is a schematic diagram comparing threat detection rates at different packet sending rates in the example.

[0040] Figure 10 This is a schematic diagram comparing threat processing latency at different packet sending rates in the embodiment;

[0041] Figure 11 This example illustrates a comparison of CPU utilization at different packet sending rates. Detailed implementation method:

[0042] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0043] IPv6 fragmentation headers can be maliciously exploited by attackers to bypass security systems such as firewalls, constituting an IPv6 fragmentation bypass threat. Figure 1As shown, the firewall is configured to block any host from sending ICMPv6 EchoRequest packets to host B. Normally, the ICMPv6 EchoRequest in the first fragment sent by host A is correctly identified and discarded by the firewall, as shown in packet 1. However, the threat attacker bypassed the firewall's detection by placing the ICMPv6 header in the second fragment, as shown in packet 2. The threat attacker exploits the IPv6 fragmentation header mechanism to split the IPv6 header chain into multiple fragments, thereby hiding critical information from upper-layer protocols, such as the ICMPv6 header information. Since most security systems primarily check the upper-layer protocol fields in the first fragment, the threat attacker can hide malicious data in subsequent fragments, thus evading detection by the security system.

[0044] IPv6 fragmentation bypass threats can be categorized based on three dimensions: IPv6 fragment length, exploitation of other IPv6 extension headers, and presence of upper-layer header protocols. The classification framework for IPv6 fragmentation bypass threats is as follows: Figure 2 As shown. These three classification dimensions are all indispensable characteristics of IPv6 fragmentation bypass threats. IPv6 fragmented packets can be divided into two categories according to fragment length: tiny fragments and normal fragments. Since IPv6 fragmentation bypass threats must be based on the combination of IPv6 extension headers, they can be divided into multiple categories according to the way different extension headers are exploited: destination option header exploitation, overlapping fragmentation vulnerability exploitation, and exploitation of a large number of extension headers of the same or different types. IPv6 is a network layer protocol, and its role is to carry upper-layer headers (such as Transmission Control Protocol TCP) and payload data. Therefore, an IPv6 fragmented packet can be classified according to whether the upper-layer header type appears.

[0045] These three classification dimensions are independent of each other and can be combined with one another. For example, any threat fragmented packet may use normal fragmentation to construct an IPv6 fragmentation bypass threat, or it may use tiny fragmentation and maliciously hide the protocol type of the upper-layer header. Therefore, in order to systematically explore the diversity of IPv6 fragmentation bypass threats, the above classifications are freely combined to obtain a total of 16 test cases, thereby constructing an IPv6 fragmentation bypass threat test suite (Frag6-TestSuite) for testing.

[0046] Currently, there is a lack of effective detection tools for IPv6 fragmentation bypass threats, and existing IPv6 threat detection methods mainly focus on local signals in threat behavior, often exhibiting limitations in generalization capabilities. This allows threat actors to bypass existing protections by constructing variant threats, leading to missed detections. For example, in Figure 2In the combined threat illustrated, the threat behavior follows a pattern of "small fragmentation → D → known upper-layer protocol type → S". Traditional detection methods typically rely on the local signal D or small fragmentation features within the threat steps for identification. However, this method is easily bypassed by other behaviors such as "normal fragmentation → A → known upper-layer protocol type → S" or "normal fragmentation → B → known upper-layer protocol type → S", leading to detection failure.

[0047] Most existing IPv6 threat detection solutions rely on user-space processing, which often creates performance bottlenecks in high-speed network environments. Furthermore, many IPv6 security vulnerabilities stem from flaws in the kernel protocol stack; attackers can trigger kernel anomalies in target systems through carefully crafted abnormal data packets, thereby achieving their threatening objectives. Therefore, intercepting and processing threat packets before they reach the kernel protocol stack is a crucial issue for ensuring high-performance detection.

[0048] Therefore, embodiments of the present invention provide an IPv6 fragmentation bypass threat detection method based on eBPF and XDP, such as... Figure 3 As shown, it includes:

[0049] S101. Set up a packet observation point in the network driver layer. The packet observation point is used to mount the Extended Berkeley Packet Filter (eBPF) program on the packet processing path using the Fast Data Path (XDP) technology.

[0050] S102. For the data packets received at the network driver layer, the eBPF program on the XDP network hook is called using the data packet observation point. The eBPF program uses a feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packets is complete.

[0051] The focus of detection is shifted from single intermediate signals to the final state S of threat behavior. By analyzing the system state changes caused by threats, IPv6 upper-layer header integrity inspection is used to achieve IPv6 fragmentation bypass threat detection, thus more effectively dealing with threat variants. eBPF and XDP technologies are introduced. eBPF is a high-efficiency virtual machine embedded in the Linux kernel, allowing dynamic loading of custom programs to perform operations such as packet filtering. XDP, as a high-performance packet processing framework based on eBPF, can process received packets at the earliest stage of the network stack, namely the network card driver layer, thereby achieving extremely low processing latency.

[0052] like Figure 4As shown, the FragEva6-Guard detection tool architecture built by the solution in this case mainly consists of five core components: packet filtering, feature parsing, threat feature extraction, upper-layer header integrity detection based on feature matching, and XDP processing decision.

[0053] XDP workflow as follows Figure 5 As shown, the XDP program can perform operations directly at the network card driver layer, such as dropping (XDP_DROP), passing (XDP_PASS), or redirecting (XDP_REDIRECT). This design greatly improves packet processing efficiency while reducing system load. In particular, XDP's dropping function can intercept and discard abnormal packets before they reach the kernel protocol stack. This not only ensures high-performance detection but also effectively prevents potential threats from triggering kernel-level vulnerabilities.

[0054] The entire architecture of the detection tool in this solution is based on eBPF and XDP technologies, with all processing completed before the IPv6 packets reach the kernel protocol stack. Specifically, firstly, the packet filtering module is responsible for filtering out potential target packets; then, the feature parsing module performs detailed parsing of the IPv6 header fields to obtain key field information; subsequently, the threat feature extraction module extracts key threat-related features from the parsed data for subsequent detection; in the feature matching stage, the system performs matching analysis based on the extracted features to determine whether the upper-layer header is complete. If the feature match is successful, it indicates that the packet poses a threat and proceeds to the next step; if no match is found, it is determined to be safe; finally, based on the matching result, the XDP processing decision module executes corresponding instructions: for packets identified as threats, the system will discard the packet using the XDP_DROP instruction; while for safe packets, the system will return the XDP_PASS instruction, allowing them to enter the network protocol stack, thereby ensuring that normal network service functions are not affected.

[0055] In the eBPF program, two address variables can be used to point to the start and end addresses of the Ethernet data frames received by the network driver layer, respectively. The data type of the address variables can be converted to pointers to extract IP layer data packets and TCP / UDP layer data packets through the address variables.

[0056] Specifically, the eBPF program, which uses a feature matching strategy to identify and filter packets with potential threats, can be designed to include:

[0057] The data packets are parsed layer by layer starting from the Ethernet data frame, and potential target data packets are filtered out from the IPv6 data packets. The potential target data packet is the first fragment data packet in the IPv6 fragment data packet.

[0058] Parse the header fields of potential target data packets and obtain key fields from the extended header of the data packets; extract key threat-related features from the key fields of the data packet header; match the extracted key features with the target threat features;

[0059] If a match is found, the potential target data packet is determined to be a threat and a packet drop operation is performed; otherwise, the potential target data packet is determined to be a safe data packet and an operation is performed to allow the data packet to enter the network protocol stack.

[0060] Before matching the extracted key features of the data packets with the target threat features, the target threat features can be obtained through the following steps:

[0061] An IPv6 fragmentation bypass threat detection tree is constructed based on the final state of the IPv6 fragmentation bypass threat behavior. Each node of the detection tree represents a detection feature, and the leaf nodes of the detection tree represent the final state of threat detection. The final state of threat detection is divided into threat type or non-threat type.

[0062] Based on the leaf nodes of the detection tree and threat type, the threat feature detection path of the IPv6 fragmentation bypass threat is obtained, and the target threat feature is composed of the threat detection path.

[0063] Available as Figure 6 The IPv6 fragmentation bypass threat detection tree shown identifies the main characteristics of the threat. Each node in the tree represents a detection feature, and the leaf nodes indicate the final detection state, which can be either a threat or a non-threat.

[0064] in:

[0065] T: Indicates a threat; the IPv6 upper-layer header is incomplete.

[0066] A: Indicates the first fragment, with the offset field value of the IPv6 fragment header being 0.

[0067] B: Indicates that more fragments are included; the More Fragments field value in the IPv6 fragmentation header is 1.

[0068] C: indicates that the upper-layer header type has been obtained, that is, the value of the next header field (Last_nh) of the last extended header is equal to the protocol type of common upper-layer headers.

[0069] D: Indicates that the TCP header is complete, meaning the payload length of the first fragment packet is greater than or equal to 20 bytes.

[0070] E: Indicates that the ICMPv6 (Internet Control Message Protocol version 6) or UDP (User Datagram Protocol) header is complete, meaning that the payload length of the first fragment packet is greater than or equal to 8 bytes.

[0071] Depend on Figure 6 It can be seen that there are three paths to detect threat T, namely: These three paths are abstracted into three feature expressions, each feature detecting a specific type of threat. All features check for bypass threats in all IPv6 fragment headers. The combined detection logic expression is as follows:

[0072]

[0073] The combination of A and B indicates that the current fragmented data packet is the first fragment. Without the constraint of condition B, an atomic fragmented data packet might be obtained, which cannot constitute a fragmentation bypass threat. Therefore, such cases need to be filtered out. Thus, three features can be extracted:

[0074] Feature 1:

[0075] Threat attackers can construct IPv6 fragmentation bypass threats by specifying the next header field of the last extended header of the first fragmented packet, which may be a known or unknown upper-layer protocol.

[0076] When C is true, it indicates that the upper-layer protocol type is known. Taking a common upper-layer protocol as an example, when Last_nh = 6, it means that the upper-layer protocol is TCP. When C is false, it indicates that the upper-layer protocol type is unknown. For example, if Last_nh = 60, it means that the next header is the destination options header, and the actual upper-layer protocol type is unknown.

[0077] Since Last_nh is the value of the next header after the last extended header of the first fragment, when Last_nh = 60, it means that the next destination option extended header must appear in the second fragment. It can be deduced that the real upper-layer protocol header must be in the subsequent fragment, indicating that an IPv6 fragmentation bypass threat has occurred.

[0078] Feature 2:

[0079] As can be seen from feature 1, C being true indicates that the upper-layer protocol type is known. Common upper-layer protocol types are 6 (TCP), 17 (UDP), and 58 (ICMPv6). Since the header length of ICMPv6, UDP, etc. is 8 bytes, when E is false, it means that the upper-layer protocol header is incomplete when it is ICMPv6 or UDP, indicating that an IPv6 fragmentation bypass threat has occurred.

[0080] Feature 3:

[0081] A true value for C indicates that the upper-layer protocol type is known. Similar to feature 2, feature 3 targets the TCP protocol header type. The key information of TCP is stored in the first 20 bytes, so when D is false, it means that the TCP header is incomplete, indicating that an IPv6 fragmentation bypass threat has occurred.

[0082] Specifically, matching the extracted key features with target threat features can be designed to include:

[0083] Based on key characteristics, determine whether the upper-layer header type of the data packet belongs to a specified type, which includes: TCP type or ICMPv6 / UDP type;

[0084] If the upper-layer header type of the data packet belongs to the specified type, it is determined whether the data packet fragment payload length is within the corresponding effective payload range. If it is within the effective payload range, it is determined that the data packet header is complete and the data packet is a secure data packet. If it is not within the effective payload range, it is determined that the data packet header is incomplete and the data packet has an IPv6 fragmentation bypass threat.

[0085] If the upper-layer header type of the data packet does not belong to the specified type, the upper-layer header type of the data packet is determined to be an unknown type, and the data packet has an IPv6 fragmentation bypass threat.

[0086] The following code listing demonstrates a simple XDP program framework. Its core function is to parse the extended headers in IPv6 packets and make a judgment based on the integrity of the header chain:

[0087]

[0088]

[0089] eBPF programs running via XDP technology rely on the `xdp_md` parameter passed by the kernel for their execution environment. Within this structure, the variables `data` and `data_end` point to the start and end addresses of the Ethernet frames received from the device driver layer, respectively. These two variables allow the extraction of structures representing IP layer packets and TCP / UDP layer packets from the Linux kernel network stack. Although `data` and `data_end` store memory addresses, their data type in C is still a 32-bit unsigned integer. Converting them to pointers allows access to the stored data at these addresses. The program can then unpack the packets layer by layer, starting with the Ethernet frame and sequentially parsing the IPv6 packets and IPv6 fragment headers.

[0090] Specifically, this program can traverse and parse IPv6 extended headers until it finds an upper-layer protocol or encounters a parsing error. The key features and functionalities of this code can be summarized as follows:

[0091] The program uses the `ctx->data` and `ctx->data_end` pointers to define packet boundaries, ensuring safe and direct access to packet data. This is a fundamental aspect of XDP programming, allowing efficient packet inspection without compromising memory safety.

[0092] It enables IPv6 packet filtering, demonstrating XDP's ability to perform protocol-specific filtering at the earliest stages of the network stack. This feature is crucial for optimizing network performance by quickly dropping irrelevant traffic.

[0093] The program contains logic for identifying and processing the first fragment in an IPv6 fragmented packet. This capability is crucial for defending against fragmentation-based threats and ensuring the proper reassembly of fragmented packets.

[0094] It can perform header chain integrity checks, demonstrating XDP's ability to perform deep packet inspection and verify complex protocol structures. This feature is crucial for detecting malformed packets that may exploit network stack vulnerabilities.

[0095] Using XDP_DROP demonstrates XDP's ability to immediately reject packets, a key feature for implementing efficient firewall functionality directly in the kernel.

[0096] The program's structure allows for easy expansion to handle additional IPv6 extension headers, highlighting XDP's flexibility in adapting to complex protocol scenarios.

[0097] Although this code is a framework implementation, it demonstrates XDP's core advantage: the ability to efficiently process and filter packets before they enter the protocol stack, thus providing high-performance threat detection capabilities. By further extending the framework, more types of extended headers can be parsed or additional security policies can be added to address complex network threats.

[0098] It is particularly important to emphasize that for eBPF programs running in the kernel, the eBPF verifier rigorously performs memory boundary checks. To prevent out-of-bounds errors, the program must perform boundary checks when parsing each protocol layer. In other words, all eBPF programs that can successfully run in the kernel have undergone rigorous scrutiny by the verifier, thus providing a high level of security.

[0099] Furthermore, based on the above method, this embodiment of the invention also provides an IPv6 fragmentation bypass threat detection system based on eBPF and XDP, comprising: a setting module and a detection module, wherein,

[0100] The configuration module is used to set up packet observation points in the network driver layer. These packet observation points are used to mount the Extended Berkeley Packet Filter (eBPF) program onto the packet processing path using the Fast Data Path (XDP) technology.

[0101] The detection module is used to call the eBPF program on the XDP network hook for data packets received at the network driver layer. The eBPF program uses a feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packets is complete.

[0102] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0103] The FragEva6-Guard is implemented using eBPF and XDP technologies and based on the C language. Then, the C code is converted into eBPF bytecode using the LLVM / Clang compiler toolchain, and finally the eBPF bytecode is loaded into the kernel for execution.

[0104] like Figure 7 The experimental environment shown has both hosts A and B equipped with an AMD Ryzen 9 5900HX CPU with a clock speed of 3.30GHz and 8GB of memory. Host A is running Ubuntu 23.04 with Linux kernel version 6.2, while host B is running Ubuntu 20.10 with Linux kernel version 5.8.

[0105] Comparison Method: Host A uses Frag6-TestSuite as the primary testing tool to send threat packets and continuously adjusts the packet sending rate to simulate different threat intensities. To verify the effectiveness and advantages of this solution, feature-matching-based IPv6 upper-layer header integrity detection is implemented in three different scenarios. First, a baseline model is manually implemented using Python. This model utilizes Netfilter's NFQUEUE hook mechanism to filter and parse IPv6 packets in the network protocol stack, thereby identifying and defending against potential threats. Second, improvements are made to Suricata v7.0.6, the most comprehensive open-source IDS currently supporting IPv6. These improvements primarily include enhancing the parsing module for IPv6 packet extended headers and adding specific rules to detect IPv6 fragmentation bypass threats. Specific modifications involve files such as decode-ipv6.c, decode-events.h, decode-events.c, and defrag.c, with corresponding rules added to suricata.rules. Finally, the solution is implemented using XDP. Subsequent experiments will mainly focus on comparing and analyzing the FragEva6-Guard method of this case with the baseline method and the improved Suricata method.

[0106] 1. Effectiveness

[0107] Sixteen preset IPv6 fragmentation bypass threat types were used to test FragEva6-Guard, Snortv3.1.61.0, Suricata v6.0.12, ofsoftswitch, DoTExtHdr, and NOPO. The results are as follows: Figure 8 As shown.

[0108] Among them, Snort v3.1.61.0 and Suricata v6.0.12 are two recent open-source IDS versions with high IPv6 support. ofsoftswitch, DoTExtHdr, and NOPO are three detection or protection solutions proposed for certain threats targeting IPv6 extended headers.

[0109] According to the experimental results, although Snort v3.1.61.0 and Suricata v6.0.12 both identified 8 threat types, they mainly focused on IPv6 fragmentation bypass threats when fragmented packets contain multiple extension headers of the same or different types. They failed to cover IPv6 fragmentation bypass threats such as overlapping fragmentation or fragmented packets containing no more than two destination option headers.

[0110] ofsoftswitch can identify two types of threats, while DoTExtHdr can identify 10 types of IPv6 fragmentation bypass threats, primarily due to its ability to identify small fragments and overlapping fragments. NOPO surpasses other solutions by identifying 12 threat types.

[0111] Since most of these solutions target specific threats in the IPv6 extended header, such as micro-fragmentation and overlapping fragmentation, they cannot cover all types of IPv6 fragmentation bypass threats.

[0112] FragEva6-Guard demonstrates the most comprehensive IPv6 fragmentation bypass threat identification capabilities, capable of identifying all 16 threat scenarios. This is because FragEva6-Guard does not identify specific threat types, but rather focuses on the final state of the IPv6 fragmentation bypass threat (i.e., IPv6 upper-layer header integrity check).

[0113] 2. Detection performance

[0114] Using a series of comparative experiments, host A generated and sent threat packets via Frag6-TestSuite, gradually increasing the packet sending rate to simulate threat scenarios of varying intensities. Each round of the experiment sent 100,000 threat packets, with an average packet length of 624 bytes. Threat detection rates and threat processing latency were measured for Baseline, Suricata, and FragEva6-Guard under different threat intensities. Experimental results are as follows: Figure 9 and Figure 10 As shown.

[0115] Figure 9The threat detection rates of three different methods are presented. As threat strength increases, the detection rate of the Baseline method drops significantly, especially when traffic reaches 28k packets per second (pps), detecting only 25.70% of threat packets. This inefficiency is primarily attributed to Baseline's Python implementation and reliance on Netfilter hooks, which exhibit significant performance bottlenecks under high-intensity threats. In contrast, Suricata performs well when threat traffic is below 20k pps. However, at traffic exceeding 22k pps, Suricata's detection rate begins to decline. This result is expected, as Suricata, despite being the most comprehensive open-source IDS with IPv6 support and high maintainability, still faces bottlenecks under high traffic conditions. In contrast, FragEva6-Guard maintains a near 100% detection rate across almost all threat intensities, even at the highest threat intensity (28000 pps), demonstrating excellent stability and reliability. This is thanks to FragEva6-Guard, which is based on eBPF and XDP. XDP hooks intervene in the packet processing flow earlier than Netfilter, and the C language implementation running in the kernel significantly improves the system's processing performance.

[0116] Figure 10 The threat processing latency of three methods is presented. The results show that the latency of the Baseline method fluctuates significantly, being considerably higher than the other two methods. This indicates a significant performance bottleneck when handling high-intensity threats. Suricata exhibits relatively stable latency under low-to-medium intensity threats, especially when traffic is below 22k pps, where its processing latency is almost equivalent to FragEva6-Guard. However, as threat traffic exceeds 22k pps, Suricata's processing latency increases. In stark contrast, FragEva6-Guard demonstrates the lowest threat processing latency across all threat intensities, and its latency shows a continuous decreasing trend with increasing threat intensity. Theoretically, an excellent packet processing scheme should reduce packet processing latency as packet rate increases (in other words, the processing rate also increases), and the experimental results show that FragEva6-Guard conforms to this.

[0117] 3. Network Impact

[0118] To evaluate the impact of FragEva6-Guard on real-world network performance, a series of comparative experiments were designed and implemented. Specifically, the experiments used the Frag6-TestSuite tool on host A to generate and send threat traffic of varying intensities, gradually increasing the packet sending rate to simulate diverse threat scenarios. Each round of the experiment continuously sent 624-byte packets within a fixed time period to ensure the stability and repeatability of the test scenarios. Three different detection methods—Baseline, Suricata, and FragEva6-Guard—were deployed on host B to measure their impact on network performance. Performance metrics were primarily measured by sending ICMP echo requests to host B from a third host and receiving echo responses, thereby measuring RTT and packet loss rate. The experimental results are shown in Table 1.

[0119] Table 1 Impact of different schemes on network performance

[0120]

[0121] The experimental results clearly demonstrate the impact of the three different detection methods on network performance as threat intensity increases. Firstly, Baseline performs reasonably well at lower threat intensities, but as the packet transmission rate increases, the RTT (Round-Trip Time) rises significantly, and the packet loss rate gradually climbs above 8k pps, reaching 100% at 20k pps. This phenomenon can be attributed to the design limitations of Baseline. Because it is based on Netfilter hooks and implemented in Python, its performance bottleneck gradually becomes apparent when handling high-traffic, high-intensity threats.

[0122] In contrast, Suricata performs relatively stably under low to medium threat levels. When the packet transmission rate is below 20k pps, its RTT remains between 0.4-0.9ms, with a packet loss rate of almost zero. However, as the threat level exceeds 20k pps, Suricata's performance begins to decline significantly, with the RTT rising to over 0.45ms and the packet loss rate reaching 25%. Although Suricata is currently the most mature open-source IDS with good IPv6 support, it cannot avoid latency and packet loss issues under high-intensity threat environments.

[0123] Finally, FragEva6-Guard performed excellently in all test scenarios. As the threat intensity gradually increased to 30kpps, its RTT consistently remained between 0.3-0.7ms, with a packet loss rate of 0%. Its kernel-level data processing capabilities enabled it to quickly capture and parse IPv6 fragment headers, while simultaneously performing efficient filtering and forwarding, avoiding the overhead of switching between user space and kernel space. This allowed it to maintain low latency and zero packet loss even under high threat intensity.

[0124] 4. Resource Expenses

[0125] To comprehensively evaluate the resource overhead of FragEva6-Guard, a set of comparative experiments was designed, with settings similar to previous network performance tests. The main difference is that this experiment focuses on measuring the CPU and memory usage of host B under different threat intensities when Baseline, Suricata, and FragEva6-Guard are deployed. To ensure data accuracy, the top tool was used for monitoring and recording. The CPU utilization results of the experiment are as follows: Figure 11 As shown. It should be noted that since the experimental environment uses a multi-core CPU, the CPU utilization may exceed 100%, which reflects the situation of multiple cores processing tasks in parallel, rather than the phenomenon of a single core operating under overload.

[0126] The experimental results show that the Baseline method consistently maintains CPU utilization between 101% and 104% across all threat intensities. Combined with the aforementioned experiments on performance evaluation and network impact, this high CPU utilization indicates that the Baseline method may be approaching its performance bottleneck when processing network packets. As threat intensity increases, the Baseline method struggles to effectively handle higher-intensity threat traffic, exhibiting clear signs of resource exhaustion.

[0127] In comparison, FragEva6-Guard demonstrates superior resource utilization efficiency. Experimental data shows that under low-intensity threat conditions (2k-8k pps), FragEva6-Guard's CPU utilization consistently remains below 1%, significantly lower than the resource consumption of Baseline and Suricata. Even under the highest threat intensity (28k pps), its CPU utilization only rises to 10.78%, a figure significantly better than Suricata and Baseline, fully demonstrating FragEva6-Guard's significant advantage in efficiently utilizing system resources.

[0128] Regarding memory usage, the experimental results showed that the memory consumption of the three detection methods was low under different threat intensities, and there were no significant changes. Therefore, memory usage was not included in further analysis or graphical representation.

[0129] 5. Scalability

[0130] To evaluate the scalability of FragEva6-Guard, this paper conducts an in-depth analysis of its ability to respond to and detect new types of network threats, and uses the recently disclosed CVE-2024-38063 vulnerability as an example for empirical research. CVE-2024-38063 is a high-risk Windows TCP / IP vulnerability with a CVSS (Common Vulnerability Scoring System) score of 9.8. Its root cause lies in a flaw in the implementation of the target host's IPv6 protocol stack. Specifically, when the protocol stack processes certain types of abnormal IPv6 packets, especially packets containing incorrect destination option extension headers, it may trigger a buffer overflow, leading to a serious risk of remote code execution.

[0131] FragEva6-Guard's modular architecture allows for flexible expansion to address such emerging threats. In this experiment, targeting the CVE-2024-38063 vulnerability, detection logic for the destination option extended header was added to its packet parsing module. When an unknown or anomalous option is detected, the system can immediately discard the corresponding data packet, thereby avoiding potential threats.

[0132] To verify the effectiveness of FragEva6-Guard in protecting against the CVE-2024-38063 vulnerability, a series of experiments were designed to simulate a threat attacker attempting to increase the success rate of exploitation by sending multiple threat packets each time. The experiments covered different threat intensities (number of attempts from 20 to 40, number of packets sent per attempt from 20 to 50). The results, shown in Table 2, demonstrate that FragEva6-Guard achieved a 100% detection rate under all test conditions, successfully identifying and blocking all simulated threat packets (total number of packets ranging from 400 to 2000).

[0133] Table 2 shows the detection results for the CVE-2024-38063 vulnerability.

[0134]

[0135] It is worth emphasizing that FragEva6-Guard's XDP-based implementation can process packets before they enter the kernel. This feature greatly enhances the system's robustness and avoids potential system crashes caused by abnormal IPv6 packets. By implementing early interception at the driver level, FragEva6-Guard not only effectively defends against known threats but also provides an additional layer of protection for the system, preventing the exploitation of unknown protocol stack vulnerabilities.

[0136] The above experiments demonstrate that the proposed solution can serve as a high-performance solution for IPv6 network security threats. Even under severe threats, it has minimal impact on system stability and shows promising application prospects in the field of network security detection.

[0137] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0138] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0139] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0140] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0141] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting IPv6 fragmentation bypass threats based on eBPF and XDP, characterized in that, Include: A packet observation point is set in the network driver layer. The packet observation point is used to mount the Extended Berkeley Packet Filter (eBPF) program on the packet processing path using the Fast Data Path (XDP) technology. For data packets received at the network driver layer, the eBPF program on the XDP network hook is invoked using the data packet observation point. The eBPF program uses a feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract key features of the data packets, match the extracted key features of the data packets with the target threat features, and determine whether the upper layer header of the data packets is complete. The step of matching the extracted key features with target threat features includes: Based on key characteristics, determine whether the upper-layer header type of the data packet belongs to a specified type, which includes: TCP type or ICMPv6 / UDP type; If the upper-layer header type of the data packet belongs to the specified type, it is determined whether the data packet fragment payload length is within the corresponding effective payload range. If it is within the effective payload range, it is determined that the data packet header is complete and the data packet is a secure data packet. If it is not within the effective payload range, it is determined that the data packet header is incomplete and the data packet has an IPv6 fragmentation bypass threat. If the upper-layer header type of the data packet does not belong to the specified type, the upper-layer header type of the data packet is determined to be an unknown type, and the data packet has an IPv6 fragmentation bypass threat.

2. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1, characterized in that, In the eBPF program, two address variables are used to point to the start and end addresses of the Ethernet data frames received by the network driver layer, respectively. The data type of the address variables is converted to pointers so that IP layer data packets and TCP / UDP layer data packets can be extracted through the address variables.

3. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1 or 2, characterized in that, The eBPF program uses a feature-matching strategy to identify and filter packets containing potential threats, including: The data packets are parsed layer by layer starting from the Ethernet data frame, and potential target data packets are filtered out from the IPv6 data packets. The potential target data packet is the first fragment data packet in the IPv6 fragment data packet. Parse the header fields of potential target data packets and obtain key fields from the extended header of the data packets; extract key threat-related features from the key fields of the data packet header; match the extracted key features with the target threat features; If a match is found, the potential target data packet is determined to be a threat and a packet drop operation is performed; otherwise, the potential target data packet is determined to be a safe data packet and an operation is performed to allow the data packet to enter the network protocol stack.

4. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 3, characterized in that, The data packets are parsed layer by layer, starting from the Ethernet data frame, and potential target packets are filtered out from the IPv6 packets, including: Starting with Ethernet data frames, IPv6 packets are extracted through packet parsing and filtering. Parse IPv6 packets and filter out IPv6 fragmented packets; Parse and filter IPv6 fragmented packets to identify potential target packets.

5. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1, characterized in that, Key characteristics of data packets include: upper-layer header type and fragment payload length.

6. The IPv6 fragmentation bypass threat detection method based on eBPF and XDP according to claim 1, characterized in that, Before matching the extracted key features of the data packets with the target threat features, it also includes: An IPv6 fragmentation bypass threat detection tree is constructed based on the final state of the IPv6 fragmentation bypass threat behavior. Each node of the detection tree represents a detection feature, and the leaf nodes of the detection tree represent the final state of threat detection. The final state of threat detection is divided into threat type or non-threat type. Based on the leaf nodes of the detection tree and threat type, the threat feature detection path of the IPv6 fragmentation bypass threat is obtained, and the target threat feature is composed of the threat detection path.

7. An IPv6 fragmentation bypass threat detection system based on eBPF and XDP, characterized in that, It includes: a settings module and a detection module, wherein, The configuration module is used to set up packet observation points in the network driver layer. These packet observation points are used to mount the Extended Berkeley Packet Filter (eBPF) program onto the packet processing path using the Fast Data Path (XDP) technology. The detection module is used to call the eBPF program on the XDP network hook for data packets received on the network driver layer using data packet observation points. The eBPF program uses a feature matching strategy to identify and filter data packets with potential threats. The feature matching strategy is used to extract key features of data packets, match the extracted key features of data packets with target threat features, and determine whether the upper layer header of the data packets is complete. The step of matching the extracted key features with target threat features includes: Based on key characteristics, determine whether the upper-layer header type of the data packet belongs to a specified type, which includes: TCP type or ICMPv6 / UDP type; If the upper-layer header type of the data packet belongs to the specified type, it is determined whether the data packet fragment payload length is within the corresponding effective payload range. If it is within the effective payload range, it is determined that the data packet header is complete and the data packet is a secure data packet. If it is not within the effective payload range, it is determined that the data packet header is incomplete and the data packet has an IPv6 fragmentation bypass threat. If the upper-layer header type of the data packet does not belong to the specified type, the upper-layer header type of the data packet is determined to be an unknown type, and the data packet has an IPv6 fragmentation bypass threat.

8. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 6.

Images