DoQ tunnel attack detection method based on QUIC protocol extension

Abstract

The invention discloses a DoQ tunnel attack detection method based on QUIC protocol extension, and the method comprises the steps: setting that the maximum length of a sent request packet does not exceed 512 bytes when a host uses a DNS over QUIC; in the domain name request stage, a domain name to be accessed is sent to a gateway in a plaintext form for reporting, a detection mechanism deployed in the gateway stores and processes the domain name, and an effective characteristic value is calculated; in a handshake stage, a detection mechanism firstly performs isolated DNS over QUIC request detection, calculates an effective feature value, then performs QUIC fingerprint identification white list detection on an initial handshake process, and calculates a similarity score; in a host transmission stage, a detection mechanism performs flow analysis on a transmitted request data packet and calculates an effective characteristic value; and (5) carrying out weight distribution on all effective feature values and similarity scores obtained by detection, calculating a detail judgment probability, and finally judging whether the traffic is tunnel attack traffic. According to the method, real-time DNS over QUIC tunnel attack detection is supported, and relatively high accuracy can be obtained.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular to a DoQ (DNS over QUIC) tunnel attack detection method based on QUIC protocol extension. Background Art

[0002] DNS Tunneling is a technology that uses the DNS protocol for data transmission. It allows non-DNS data to be embedded in DNS queries and responses. The conventional attack method is as follows: the attacker controls at least one host in the LAN and at least one authoritative domain name server outside the LAN. The controlled host will initiate a DNS query, and its destination domain name is the domain name under the control of the authoritative domain name server controlled by the attacker. When DNS tunneling occurs, the DNS request packet will transmit LAN data to the authoritative domain name server, and this data will be hidden, such as hidden in the domain name. After receiving the DNS request packet, the authoritative domain name server will send a DNS response packet to the controlled host. This packet contains Command & Control instructions, indicating the controlled host's next operation and the data to continue transmitting.

[0003] The reason why DNS tunnel attacks are often successful is that DNS requests are usually very frequent and the data volume is small, and conventional detection means and detection methods are difficult to effectively identify DNS tunnel attack traffic. For example, every time a user visits a website, the browser will send a DNS request to resolve the domain name, and each DNS query usually involves only a few dozen bytes of query request and response. However, traditional data packets are often used for large data transmission (such as Web content, file transfer, etc.), and their size is usually larger than DNS data packets, and the transmission frequency is low. Therefore, with the popularization of DNS tunnel technology, the field of network security is facing new challenges - most traditional traffic monitoring and detection methods are aimed at low-frequency large data transmission, which often cannot effectively identify malicious activities hidden in DNS traffic. Therefore, studying the characteristics and detection methods of DNS tunnels has become an important topic in network security research.

[0004] In recent years, the detection methods of DNS tunnel attacks have been constantly updated, which can be roughly divided into two categories: rule-based methods and model-based methods. For the former, it can be further divided into signature-based and threshold-based methods; for the latter, it can be divided into traditional machine learning and deep learning based on feature extraction methods and corresponding algorithms. At present, these DNS tunnel attack detection methods all have a core problem to solve, that is, which features to select as the judgment criteria.

[0005] For feature extraction, such as IP, port number, frequency of data packet transmission, ratio of data packet upload and download, length of data packet, time between sending and receiving data packets, etc. These features are widely used in various types of traffic analysis, and can also be applied to DNS over QUIC tunnel attack detection, but relying solely on these features will not be enough to effectively evaluate the probability of tunnel attack packets.

[0006] Although there have been many studies on DNS tunnels and many useful features have been extracted, they are either unable to process ciphertext because they are based on plaintext, or the difference in the number of initial handshakes between the HTTPS protocol and the QUIC protocol greatly reduces the effectiveness of whitelist detection. Summary of the invention

[0007] The present invention provides a DoQ tunnel attack detection method based on QUIC protocol extension, supports real-time DNS over QUIC tunnel attack detection, and can achieve good accuracy, filling the current gap in DNS over QUIC tunnel attack detection and greatly reducing the risk of DNS over QUIC being used for tunnel attacks.

[0008] A DoQ tunnel attack detection method based on QUIC protocol extension includes the following steps:

[0009] (1) Set the maximum length of the request packet sent by the host when using DNS over QUIC to no more than 512 bytes;

[0010] (2) Before using DNS over QUIC to make a domain name request, the host sends the domain name to be accessed in plain text to the gateway for reporting. The detection mechanism deployed at the gateway stores and processes the domain name and calculates multiple valid feature values ​​in the domain name processing stage.

[0011] (3) Before the host sends a DNS over QUIC request, it performs an initial handshake and enters the handshake phase. At this time, the detection mechanism deployed at the gateway first performs an isolated DNS over QUIC request detection and calculates the effective feature values ​​of the handshake phase. Then, the QUIC fingerprint recognition whitelist detection is performed on the initial handshake process and the similarity score is calculated.

[0012] (4) After the host connection is established, the encrypted data packet begins to be transmitted, entering the transmission phase. At this time, the detection mechanism performs traffic analysis on the transmitted request data packet and calculates the effective feature value of the transmission phase in combination with the DNS over QUIC response packet received subsequently.

[0013] (5) All valid feature values ​​in the domain name processing stage, handshake stage, and host transmission stage, as well as the similarity scores obtained by the QUIC fingerprint recognition whitelist detection, are weighted to further calculate the detail judgment probability P tunnel , and finally determine whether it is tunnel attack traffic.

[0014] The present invention slightly expands the QUIC protocol based on the original one, and introduces the maximum length limit of the DNS over QUIC request packet and the domain name reporting mechanism. In addition, the present invention adopts QUIC fingerprint recognition whitelist detection, so as to support real-time DNS over QUIC tunnel attack detection and achieve good accuracy.

[0015] In step (1), the present invention limits the maximum request data packet length for the following reasons:

[0016] (1-1) Considering that the QUIC protocol has set a limit on the maximum message length, that is, the maximum message length of the QUIC protocol under IPV6 is 1350 bytes, and the maximum message length under IPV4 is 1370 bytes. However, it does not set a limit on the maximum size of the data packet to be transmitted. When QUIC processes a large data packet that exceeds the MTU (maximum transmission unit) limit, it does not directly fragment it, but divides the data into smaller blocks through the flow mechanism. Each stream can be transmitted in parallel, thereby achieving the purpose of transmitting very large data packets that exceed the MTU limit. Assume an extreme case, that is, the controlled host transmits a large data packet when it transmits the request packet for the first time, and all the data required by the attacker is in this data packet. At this stage, the existing detection mechanism will only treat this traffic as suspicious traffic, and further judgment needs to wait for the response packet. At this time, it does not matter whether the authoritative domain name server responds or not, because the attack purpose has been achieved, and even if the detection mechanism finds that it is tunnel traffic, it will not help.

[0017] (1-2) Common DNS tunnel attack tools, such as iodine, dnscat2, DNSExfiltrator, etc., their uses and the total transmission traffic required to achieve the attack purpose in a statistical sense are shown in Table 1 below. It can be observed that even when using iodine, at least a few KB of traffic needs to be transmitted (the total number of data packets required to transmit in a statistical sense to achieve the attack). If the maximum packet length of the request data packet is not restricted, malicious users only need a few or even one data packet to achieve the attack purpose. By limiting the maximum packet length of the request data packet, malicious users need more transmission times to achieve the attack purpose, and more transmission times will increase the probability of tunnel attack traffic being discovered, thereby better helping the detection mechanism to detect tunnel traffic;

[0018] (1-3) The present invention observes that the size of a normal DNS request packet is limited. According to the RFC 1035 protocol, the maximum length of a DNS domain name is 255 bytes. At the same time, the DNS message header consists of a 12-byte header and 4 variable-length fields. The maximum length of the QUIC message header is 54 bytes. The conventional DNS request traffic packet size is 60 bytes. Based on the characteristic that the size of the conventional DNS request packet traffic is smaller than the tunnel attack traffic, the maximum request packet traffic can be set to define the upper limit of the threshold, which can increase the transmission frequency of the tunnel attack traffic without affecting the benign DNS over QUIC traffic.

[0019] Table 1. Purpose of common DNS tunnel attack tools and total transmission traffic in a statistical sense

[0020] tool use Total transmission volume (statistical sense) iodine C&C or file transfer A few KB to several MB dnscat2 Long-term command and control communications Tens of KB to several MB DNSExfiltrator Data breaches and file transfers A few MB to hundreds of MB

[0021] In step (1), the present invention sets 512 bytes as the upper limit of the data packet length for the following two reasons:

[0022] First, QUIC integrates TLS, and its encryption feature is that after encrypting the data, the length of the data packet will not be significantly increased. Therefore, 512 bytes will not affect the normal DNS over QUIC request packet, because even if a normal request packet needs to request an extreme 255-byte domain name, using a 12-byte DNS message header and a maximum of 54 bytes of the QUIC message header, the maximum number of bytes of 512 can still ensure the smooth execution of this request.

[0023] Second, the traditional plaintext DNS protocol is transmitted by UDP by default. To optimize transmission performance, the DNS protocol has a 512-byte limit. When the data length exceeds 512 bytes, the DNS protocol will switch to TCP for fragmented transmission. This is because the default MTU of the router is usually 576 bytes. Considering that the present invention should be compatible with the network environment in most cases as much as possible, 512 bytes is used as the upper limit of the data packet length.

[0024] In step (2), the present invention takes into account that for DNS over QUIC encrypted data packets, if only relying on the data packet header information during data packet transmission, such as IP and port number, it will be difficult to effectively identify tunnel attack traffic, and the domain name feature is the most important feature in DNS tunnel attacks, which often contains the information that the attacker wants to transmit. Therefore, the present invention will expand the DNS over QUIC protocol and add a domain name reporting mechanism. When a host in the local area network wants to request the IP of a domain name, it will first report the domain name in plain text to the gateway, and the detection mechanism deployed at the gateway will process the domain name.

[0025] In step (2), the detection mechanism deployed at the gateway stores and processes the domain name, including:

[0026] (2-1) Maintain a data table to record the domain names visited by each host in the LAN and the number of visits; when a host reports a domain name, the host name and domain name are stored in the data table. For domain names visited repeatedly, the number of visits is increased by 1. If the number of unique domain names requested by a host exceeds 300, the probability of it conducting a tunnel attack will increase.

[0027] (2-2) Calculate the length of the domain name and the proportion of special characters in the domain name. Because in the encoded data of the DNS tunnel, the proportion of special characters such as uppercase letters, numeric characters, and hyphens will be higher, and the domain name will become longer to reduce repetition, so these two can be used as effective features.

[0028] (2-3) Calculate the entropy of domain name characters. A normal domain name is readable and easy to remember, and follows Zipf's law. That is, the characters of a normal domain name should contain a few high-frequency characters and most low-frequency characters. As a result, the entropy of a normal domain name is not very high. However, the domain name of a tunnel attack is randomly generated, that is, its characters conform to random distribution, which makes the character entropy of the tunnel attack domain name higher than that of a normal domain name.

[0029] (2-4) Calculate the number of consecutive consonant characters in the domain name. When the number of consecutive consonant characters exceeds 4, the probability that the traffic packet is a tunnel attack traffic will increase significantly, because only a very small number of domain names will have 4 consecutive consonant characters, so the present invention also sets this threshold at 4.

[0030] In step (2), multiple valid feature values ​​of the domain name processing stage are calculated, specifically:

[0031] Calculate the effective feature value F1 based on the length of the subdomain:

[0032] F1=D sub =D complete -D sec , D sec <D complete <256

[0033] Among them, D complete is the length of the fully qualified domain name, D sec is the length of the second-level domain name, D sub is the length of the subdomain, that is, the part before the second-level domain name;

[0034] For the longest subdomain, calculate the effective feature value F2:

[0035]

[0036] Among them, D submax is the maximum length in the subdomain set, M is the number of subdomain levels, D subi is the length of the i-th subdomain;

[0037] For continuous consonant characters, calculate the effective eigenvalue F3:

[0038]

[0039] Where N represents the number of consecutive consonant strings in the subdomain, and D consonanti is the length of the i-th continuous consonant string in the subdomain, and the count() function is used to calculate D consonamti >4;

[0040] For the entropy of the domain name, the formula of Shannon information entropy is used to calculate the effective eigenvalue F4:

[0041]

[0042] Where n represents the number of non-repeated characters in the subdomain name, C i Indicates the i-th character in the subdomain, P(C i ) represents the frequency of occurrence of the i-th character in the subdomain in the entire string;

[0043] For non-repeated domain names, calculate the effective feature value F5:

[0044] F5=1 / D pre

[0045] Among them, D pre Indicates the number of domain names that have been visited by the host in the data table. If the domain name does not exist, this value is set to 1.

[0046] In step (3), the existing TLS fingerprint recognition whitelist detection mechanism, such as Yue et al [YueWang, AnminZhou, Shan Liao, Rongfeng Zheng, Rong Hu, Lei Zhang, A comprehensive survey on DNStunnel detection, Computer Networks, Volume 1 97, 2021, 1 08322, ISSN 1389-1286, https: / / doi.org / 10.1016 / j.comnet.2021.108322.], is limited to DNS over HTTPS because its outermost data packet is TLS, while the outermost data packet of DNS over QUIC is QUIC. Because QUIC has TLS embedded in it, its handshake only requires one time, while the handshake of HTTPS requires a total of 7 handshakes. This enables TLS fingerprint recognition to obtain a large number of features to form an effective fingerprint. Therefore, after the existing TLS fingerprint recognition whitelist detection mechanism is migrated to DNS over QUIC, its effect will be greatly reduced. However, this mechanism is still a relatively effective detection method, so the present invention decides to adopt the QUIC fingerprint recognition whitelist detection mechanism, but will give less weight to the similarity score it finally generates.

[0047] In addition, thanks to the long-term and widespread popularity of TLS fingerprinting, there are now many relatively complete TLS fingerprinting shared databases, so that the relatively complete data on the Internet can be directly used for TLS fingerprinting whitelist detection. QUIC has only been around for a short time, so shared databases for QUIC fingerprinting are relatively scarce, and ready-made shared databases on the Internet cannot be used immediately. Therefore, the present invention will first collect QUIC fingerprinting data and establish a relatively complete database for DNS over QUIC traffic, which can help detect subsequent DNS over QUIC tunnel attacks.

[0048] In step (3), the present invention performs the following operations:

[0049] (3-1) Calculate the effective eigenvalues ​​in the handshake phase, specifically:

[0050] Monitor isolated DNS over QUIC requests. The detection mechanism will maintain a data table and take out the isolated DNS over QUIC request value Num from the data table. orphan , set up the effective eigenvalue F6:

[0051]

[0052] After this, let Num orphan =F6 and write it back to the data table.

[0053] (3-2) Perform QUIC fingerprint identification whitelist detection on the initial handshake process and calculate the similarity score, specifically:

[0054] When the host performs the initial handshake of the DNS over QUIC protocol, the detection mechanism needs to collect information at this stage and extract key features from the collected information; the extracted key features are formed into a specific hash value using a hash function, and then the hash value is converted into a Similarity Digest (similarity feature summary), which is the QUIC fingerprint recognition data, and then compared with the data in the collected QUIC fingerprint recognition database to extract the final similarity score SC of the two. rarget,data .

[0055] Among them, the key features include QUIC version (QUIC version supported by the client and server, such as QUIC v1), connection ID (QUIC uses connection ID to identify a specific connection, which can help track the status and mode of the connection), TLS version (QUIC usually uses TLS1.3 to encrypt data, and extracting the TLS version helps identify the encryption mechanism), encryption suite (a list of encryption algorithms negotiated by the client and server. Different services may use different encryption suites), extension fields (fields such as ServerName Indication and Application-Layer Protocol Negotiation, which help further identify the application layer protocol), random numbers (random numbers generated by the client and server in the TLS handshake, which help generate a unique connection identifier), flow control information, packet size, stream ID and other information.

[0056] In step (4), the deployed detection mechanism performs the following operations:

[0057] (4-1) Collect the number of data packets, request packet length and response packet length during the transmission phase, and calculate the ratio of request packet length / response packet length. Because the request packet of the tunnel attack needs to transmit data, its length will be longer than the normal request packet, which will reduce the ratio. In addition, because of the need to transmit data, the frequency of sending tunnel attack requests will be greater than that of normal request packets, which will be reflected on the gateway as an increase in the number of data packets. Therefore, both can be used as effective judgment features.

[0058] (4-2) Record the time it takes for the request traffic packet to pass through the gateway and the time it takes for the response traffic packet to pass through the gateway, and calculate the time it takes in between. However, this time is only stored and not used as a basis for judgment. The reasons are as follows: most of the domain names visited by general users are popular domain names, and there is a high probability that such domain names are cached in the recursive resolver. So when users visit these domain names, the recursive resolver directly takes them out of the cache and returns them to the host. In this case, the time between the request packet and the response packet is relatively short. In order for malicious users to implement DNS tunnel attacks, the cache of the recursive resolver must not hit, which makes the time between the request packet and the response packet longer. Based on this, it can be inferred that data packets with long time are more likely to be tunnel attack traffic. However, a normal authoritative domain name server may need to interact with multiple authoritative domain name servers, that is, let the recursive resolver search for other authoritative domain name servers again. Each query takes a certain amount of time, which affects the overall response time. Because the controlled authoritative domain name server does not need to interact, it will directly send a response packet, thereby shortening the time between the request packet and the response packet. Based on the two conflicting situations above, the time parameter is only collected but not used as one of the criteria for detection.

[0059] In step (4), the effective eigenvalue of the transmission phase is calculated, specifically:

[0060] Calculate the effective characteristic value F7 based on the request packet length:

[0061] F7=Size req / 60

[0062] Among them, Size req is the request packet length. 60 bytes is a statistical value obtained based on the normal DNS request packet size.

[0063] Calculate the effective characteristic value F8 based on the number of data packets:

[0064] F8=Num package

[0065] Among them, Num package is the number of packets;

[0066] According to the relationship between the request packet length and the response packet length, the effective characteristic value F9 is calculated:

[0067] F9=Ratio req / res =Size req / Size res

[0068] Among them, Ratio req / res Indicates the ratio of request packet length to response packet length, Sizereq Indicates the request packet length, Size res Indicates the length of the response packet.

[0069] In step (5), weight allocation is performed, specifically:

[0070] For the five valid feature values ​​F1~F5 in the domain name processing stage, a total weight of 0.6 is assigned; for the valid feature value of the isolated DNS request, that is, F6, a weight of 0.05 is assigned; for the QUIC fingerprint recognition whitelist detection result, that is, SC target，data , a weight of 0.15 is assigned; for the three valid eigenvalues ​​F7~F9 in the transmission stage, a weight of 0.2 is assigned.

[0071] Calculate the detail judgment probability P tunnel The formula is:

[0072]

[0073] When P tunnel When >0.6, it is determined to be tunnel attack traffic.

[0074] Compared with the prior art, the present invention has the following beneficial effects:

[0075] 1. The present invention fills the gap in DNS over QUIC tunnel attack detection. Most of the existing works are currently aimed at plaintext DNS or DNS over HTTPS. These existing methods are difficult to deal with the DNS over QUIC tunnel attack mode.

[0076] 2. The present invention can be deployed at the gateway for real-time detection. Most existing solutions, especially those using machine learning, are difficult to deploy in real time because the response time of AI is much longer than the response time of the code mechanism. Therefore, AI is difficult to deploy in real time in networks with high throughput.

[0077] 3. Compared with the tunnel attack detection method using machine learning models, the present invention has high robustness and defense capabilities. The training of AI models requires a large amount of sample data, which is difficult for laboratories to collect locally. At the same time, few large certification organizations disclose DNS data, so laboratories using machine learning solutions often use data shared on the Internet for model training. At this time, researchers cannot effectively identify whether the data has been maliciously injected, and the model trained with this data is vulnerable to backdoor attacks. The detection mechanism deployed by the present invention will not have such problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 Schematic diagram of two DNS models.

[0079] Figure 2 This is a flow chart of a DoQ tunnel attack detection method based on QUIC protocol extension according to an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be pointed out that the embodiments described below are intended to facilitate the understanding of the present invention and do not have any limiting effect on the present invention.

[0081] The present invention needs to determine the research model first. There are currently two common models, such as Figure 1 As shown. Most of the papers in the prior art are based on the model in the first case, that is, there is a DNS recursive resolver in the local area network, but this situation mostly exists in organizations such as enterprises. If it is for more general situations such as home use, such as the second model, many features will be difficult to obtain due to the lack of a DNS recursive resolver. In order to better adapt to the series of changes brought about by DNS over QUIC and make the subsequent solution more universal, this invention will take the second model as the research object.

[0082] After the model is determined, the research objectives of the present invention are as follows: On the basis of the second model, by deploying a DNS over QUIC tunnel attack detection mechanism at the gateway, when a DNS over QUIC data packet passes through the gateway, this mechanism can perform traffic analysis based on the overall data packet situation and evaluate the probability that the data packet is a tunnel attack packet, thereby being able to efficiently identify whether this traffic is malicious tunnel traffic.

[0083] like Figure 2 As shown, a DoQ tunnel attack detection method based on QUIC protocol extension includes the following steps:

[0084] Step S1, before sending the DNS over QUIC data packet, the QUIC protocol is detected.

[0085] 1) Check if the port is 853, because according to RFC 9250, by default, a DNS client that uses DNS over QUIC with a specific server must establish a QUIC connection with the server's UDP port 853, unless it and the server agree to use another port. However, no handshake negotiation is performed before this packet is sent, and the default port number will not change, so it can be determined whether it is DNS over QUIC traffic based on this port number.

[0086] 2) If the port number is 853, the protocol should continue to check the DNS message ID and the length of the data packet. Because the RFC 9250 protocol stipulates that when sending DNS queries via a QUIC connection, the DNS message ID must be set to 0. For a data packet with message ID = 0, if its length exceeds 512 bytes, an error code DOQ_EXCESSIVE_LOAD with a value of 0x4 should be returned to the host. This error code indicates that the request packet is overloaded and needs to be re-requested.

[0087] Step S2: Before the host performs a QUIC handshake, the host needs to send a plaintext domain name to the gateway for reporting. At this time, the detection mechanism deployed at the gateway stores and processes the domain name, and calculates multiple valid feature values ​​of the domain name processing stage.

[0088] The present invention defines the following symbols and assigns them corresponding meanings in domain name processing: The length of the full domain name D complete , the length of the second-level domain name D sec , the length of the subdomain (i.e. the part before the second-level domain) D sub , the length of the i-th subdomain D subi , the number of subdomain levels M, the maximum length D in the subdomain set submax , the length of the continuous consonant string in the subdomain D consonant , the length D of the i-th continuous consonant string in the subdomain consonanti , the number of consecutive consonant strings in the subdomain N, the i-th character in the subdomain C i , the frequency of the i-th character in the subdomain in the entire string P(C i ), the number of non-repeated characters in the subdomain name n, the number of domain names that the host has visited that already exists in the data table D pre (If this domain name does not exist, this value is set to 1) The units of the above lengths are all bytes.

[0089] The detailed operations of the present invention in domain name processing are as follows:

[0090] 1) Calculate the effective feature value F1 based on the length of the subdomain:

[0091] F1=D sub =D complete -D sec , D sec <D complete <256

[0092] 2) For the longest subdomain, calculate the effective feature value F2:

[0093]

[0094] 3) For continuous consonant characters, calculate the effective feature value F3:

[0095]

[0096] 4) For the entropy of the domain name, the formula of Shannon information entropy is used to calculate the effective eigenvalue F4:

[0097]

[0098] Among them, there are 26 English characters, 10 numbers, and separators are not counted, so a total of 26+10=36 is used as the summation upper limit, from which we can get 0<n<36, 0 <F4<log n;

[0099] 5) For non-repeated domain names, calculate the effective feature value F5:

[0100] F5=1 / D pre

[0101] 6) Store this domain name in the data table to prepare for future tunnel attack detection.

[0102] Step S3, during the handshake phase of the host, the detection mechanism deployed at the gateway first performs isolated DNS over QUIC request detection and calculates the effective feature values ​​of the handshake phase; then performs QUIC fingerprint recognition whitelist detection on the initial handshake process and calculates the similarity score.

[0103] The present invention will define the following symbols and give them corresponding meanings:

[0104] QUIC Version E QUIC 、Connection ID connection 、TLS version E TLS 、Cipher Suite T encryption , Extended field C extension 、Random number Num random , flow control information M control , Packet size L package , stream ID ID flow 、Structure S handshake 、Hash value H of handshake handshake , the isolated DNS over QUIC request value Num in the data table maintained by the gateway irphan , the i-th Bloom filter BF i , Similarity Digest SD of data packets target , Similarity Digest SD of data in QUIC fingerprint database data , the number of features of the data packet N target, the number of features N of the data in the QUIC fingerprint database data 、Num of sub-hash numbers subHash , Size of Bloom filters Bloom filters , the maximum number of features inserted in Bloom filters Num maxBloom filters , the similarity score SC between two data i and j i，j 、Number of Bloom filters Bloom filters 、Num, the number of Bloom filters in the data packet targetBloom filters 、Num, the number of Bloom filters of data in the QUIC fingerprint database dataBloom filters , Hamming Similarity HS between the i-th Bloom filters and the j-th Bloom filters i，j .

[0105] The detection mechanism deployed at the gateway should perform the following detailed operations during the handshake phase:

[0106] 1) For isolated DNS over QUIC requests, take out Num from the data table irphan , set up the effective eigenvalue F6:

[0107]

[0108] After this, let Num irphan =F6, and write it back to the data table;

[0109] 2) Collect E for the interactive information in the handshake phase QUIC 、ID connection 、E TLS , T encryption , C extension 、Num random 、M control , L package 、ID flow etc., let S handshake ={E QUIC , ID connection , E TLs , T encryption , C extension , Num random , M control , L package , ID flow}, calculate the hash value H handshake =SHA1(S handshake );

[0110] 3) Convert the hash value to Similarity Digest for operation. handshake The length of H is 160 bits, so the present invention uses H handshake Split into 5 32-bit sub-hashes, then Num subHash =5. Each sub-hash is considered a different hash value, and its 11 least significant bits are used as indexes in the Bloom filters bit array. These features are inserted into 256-byte Bloom filters (Size Bloom filters =256×8=2048=2^11). The capacity of a single Bloom filter is fixed at 128 features. When the capacity of the Bloom filter is reached, a new Bloom filter will be created, and so on, until all features are represented. From this, we can calculate the Similarity Digest SD generated by this handshake data data :

[0111]

[0112] 4) Use Hamming Similarity (HS) to calculate the similarity between the data in the handshake phase and the data in the collected QUIC fingerprint database. The Hamming Similarity (HS) formula is as follows:

[0113]

[0114] Among them, n i It's BF i The characteristic number, e i，j For BF i and BF j The number of bits set to 1 in both, that is, the intersection of the two, E max is the maximum number of matching digits, E min is the minimum number of matching bits, N min is the minimum number of features required to calculate the HS value in Bloom filters, t c is a threshold below which any match is considered accidental, t c The calculation is as follows:

[0115] t c =0.25*(E max -E min )+E min

[0116] 5) After obtaining HS, we can calculate the similarity score SC between the captured data packet and the data in the QUIC fingerprint recognition database target，data :

[0117]

[0118] 6) For SC target，data If SC target，data >21, then the detection mechanism believes that the two are highly similar, that is, the current handshake packet is in the whitelist, and the probability that it is a tunnel attack packet decreases. On the contrary, the probability that it is a tunnel attack packet increases.

[0119] Step S4, host transmission phase, the detection mechanism performs traffic analysis on the transmitted request data packet, and calculates the effective feature value of the transmission phase in combination with the subsequently received DNS over QUIC response packet.

[0120] The present invention defines the following symbols and assigns them corresponding meanings: Number of packets Num package , request packet length Size req , Response packet length Size res , the ratio of request packet length to response packet length req / res , the lengths above are in bytes;

[0121] 1) Calculate the effective characteristic value F7 based on the request packet length:

[0122] F7=Size req / 60

[0123] The 60 bytes is a statistical value obtained based on the normal DNS request packet size, that is, the normal DNS request packet size should be around 60 bytes.

[0124] 2) Calculate the effective characteristic value F8 based on the number of data packets:

[0125] F8=Num package

[0126] 3) Calculate the effective characteristic value F9 based on the relationship between the request packet length and the response packet length:

[0127] F9=Ratio req / res =Size req / Size res

[0128] Step S5: weight all valid feature values ​​and similarity scores obtained from the QUIC fingerprint recognition whitelist detection, and calculate the detail determination probability P tunnel , and finally determine whether it is tunnel attack traffic.

[0129] For the five valid feature values ​​in the domain name processing stage, i.e., F1 to F5, a total weight of 0.6 will be assigned; for the valid feature value of the isolated DNS request, i.e., F6, a weight of 0.05 will be assigned; for the QUIC fingerprint recognition whitelist detection result, i.e., SC target，data , a weight of 0.15 will be assigned; for the three valid eigenvalues ​​in the transmission stage, namely F7~F9, a weight of 0.2 will be assigned.

[0130] Detail judgment probability P tunnel The algorithm is as follows:

[0131]

[0132] To verify the effect of the solution designed in the present invention, this embodiment uses a 13th Gen Intel(R) Core(TM) i5-13400 2.50 GHz, 10-core 16-thread computer with a maximum operating memory of 16 GB to perform simulation experiments.

[0133] The experiment was conducted using all 20,322 benign traffic data in [(2021).CIC-Bell-DNS-EXF-2021Dataset.Accessed: Oct.20, 2023.[Online].Available: https: / / www.unb.ca / cic / datasets / dns-exf-2021.html] and 20,000 malicious traffic data constructed in a laboratory environment. The detection mechanism deployed by the present invention is determined as follows:

[0134] 1) The maximum tunnel probability of benign traffic is 0.6017061838622095;

[0135] 2) The minimum tunnel probability of malicious traffic is 0.6314663669274182, the maximum tunnel probability is 0.9837955434188381, and the average tunnel probability is 0.8111350626397091.

[0136] So when P tunnel When >0.6, the present invention considers that the host is transmitting suspicious traffic packets and may carry out tunnel attacks, and will send a warning message to the network administrator to inform the name of the host and the risk of tunnel attacks.

[0137] This example uses the following indicators for performance evaluation:

[0138]

[0139] Among them, TP (True Positives) indicates the number of DNS over QUIC tunnel traffic correctly identified, TN (True Negatives) indicates the number of legal traffic correctly identified, FN (False Negatives) indicates the number of DNS over QUIC tunnel traffic misidentified as legal traffic, and FP (False Positives) indicates the number of legal traffic misidentified as DNS over QUIC tunnel traffic.

[0140] Because the present invention uses Hamming Similarity to calculate the similarity score, it will also produce errors. A.Qasem et al[A.Qasem,S.Zhioua,and K.Makhlouf,

[0141] "Finding a needle in a haystack:The traffic analysis version," Proc. Privacy Enhancing Technologies, 2019. DOI: 10.2478 / popets 2019-0030.] points out that its theoretical Recall = 1-0.139% = 0.99861, Precision = 0.98, and the weight ratio allocated to it by the present invention is 0.15, so the theoretical impact of this method in the present invention is Recall = 0.15*0.99861 = 0.1497915, Precision = 0.98*0.15 = 0.147.

[0142] In summary, the performance indicators of the present invention under the laboratory environment are shown in Table 2 below:

[0143] Table 2 Performance indicators of 40322 data in laboratory environment

[0144] Experimental value\indicator Accuracy Recall Precision Experimental value 0.987 0.993 0.981

[0145] The above results show that the present invention can achieve higher Accuracy, Recall, and Precision.

[0146] It can be observed here that the three are not extremely close to 1.0, such as 0.999, etc. Consider an extreme case, that is, the attacker has very little content to transmit, and the common size of the benign traffic request packet, that is, 60 bytes, can achieve the attack purpose. For this extreme case, the detection mechanism deployed by the present invention will be difficult to identify, but the proportion of this attack volume in the actual total tunnel attack volume is very low, so it does not affect the actual deployment of the present invention.

[0147] The present invention fills the gap in DNS over QUIC tunnel attack detection. Most of the existing work currently targets plaintext DNS or DNS over HTTPS. These existing methods are difficult to deal with DNS over QUIC tunnel attack mode. The detection mechanism deployed by the present invention can effectively detect DNS over QUIC tunnel attacks, thereby enhancing the overall security within the local area network.

[0148] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A DoQ tunnel attack detection method based on QUIC protocol extension, characterized in that: The following steps are involved: (1) Set the maximum length of the request packet sent by the host when using DNS over QUIC to no more than 512 bytes; (2) Before using DNS over QUIC to make a domain name request, the host sends the domain name to be accessed in plain text to the gateway for reporting. The detection mechanism deployed at the gateway stores and processes the domain name and calculates multiple valid feature values ​​in the domain name processing stage. (3) Before the host sends a DNS over QUIC request, it performs an initial handshake and enters the handshake phase; At this point, the detection mechanism deployed at the gateway first performs isolated DNS over QUIC request detection and calculates the effective feature values ​​in the handshake phase; Then perform QUIC fingerprint identification whitelist detection on the initial handshake process and calculate the similarity score; (4) After the host connection is established, the encrypted data packet begins to be transmitted, entering the transmission phase; At this point, the detection mechanism performs traffic analysis on the transmitted request packets and calculates the effective feature values ​​of the transmission phase in combination with the DNS over QUIC response packets received later; (5) All valid feature values ​​in the domain name processing stage, handshake stage, and host transmission stage, as well as the similarity scores obtained by the QUIC fingerprint recognition whitelist detection, are weighted to further calculate the detail judgment probability P tunnel , and finally determine whether it is tunnel attack traffic.

2. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (2), the detection mechanism deployed at the gateway stores and processes the domain name, including: (2-1) Maintain a data table to record the domain names visited by each host in the LAN and the number of visits; when a host reports a domain name, store the host name and domain name in the data table, and for domain names visited repeatedly, increase the number of visits by 1; (2-2) Calculate the length of the domain name and the proportion of special characters in the domain name; (2-3) Calculate the entropy of domain name characters; (2-4) Calculate the number of consecutive consonant characters in the domain name.

3. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 2 is characterized in that: In step (2), multiple valid feature values ​​of the domain name processing stage are calculated, specifically: Calculate the effective feature value F1 based on the length of the subdomain: F1=D sub =D complete -D sec ,D sec <D complete <256 Among them, D complete is the length of the fully qualified domain name, D sec is the length of the second-level domain name, D sub is the length of the subdomain, that is, the part before the second-level domain name; For the longest subdomain, calculate the effective feature value F2: Among them, D submax is the maximum length in the subdomain set, M is the number of subdomain levels, D subi is the length of the i-th subdomain; For continuous consonant characters, calculate the effective eigenvalue F3: Where N represents the number of consecutive consonant strings in the subdomain, and D consonanti is the length of the i-th continuous consonant string in the subdomain. The count() function is used to count D consonanti >4; For the entropy of the domain name, the formula of Shannon information entropy is used to calculate the effective eigenvalue F4: Where n represents the number of non-repeated characters in the subdomain name, C i Indicates the i-th character in the subdomain, P(C i ) represents the frequency of occurrence of the i-th character in the subdomain in the entire string; For non-repeated domain names, calculate the effective feature value F5: F5=1 / D pre Among them, D pre Indicates the number of domain names that have been visited by the host in the data table. If the domain name does not exist, this value is set to 1.

4. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (3), the effective eigenvalues ​​of the handshake phase are calculated, specifically: Monitor isolated DNS over QUIC requests. The detection mechanism will maintain a data table and take out the isolated DNS over QUIC request value Num from the data table. orphan , set up the effective eigenvalue F6: After this, let Num orphan =F6 and write it back to the data table.

5. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (3), the QUIC fingerprint recognition whitelist detection is performed on the initial handshake process, and the similarity score is calculated, specifically: When the host performs the initial handshake of the DNS over QUIC protocol, the detection mechanism needs to collect information at this stage and extract key features from the collected information; The extracted key features are used to form a specific hash value using a hash function, and then the hash value is converted into a similarity feature summary, that is, QUIC fingerprint recognition data, which is then compared with the data in the collected QUIC fingerprint recognition database to extract the final similarity score SC of the two. target,data .

6. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 5 is characterized in that: Key features include QUIC version, connection ID, TLS version, cipher suite, extension field, random number, flow control information, packet size, stream ID.

7. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (4), the effective eigenvalue of the transmission phase is calculated, specifically: Calculate the effective characteristic value F7 based on the request packet length: F7=Size req / 60 Among them, Size req is the request packet length. 60 bytes is a statistical value obtained based on the normal DNS request packet size. Calculate the effective characteristic value F8 based on the number of data packets: F8=Number package Among them, Num package is the number of packets; According to the relationship between the request packet length and the response packet length, the effective characteristic value F9 is calculated: F9=Ratio req / res =Size req / Size res Among them, Ratio req / res Indicates the ratio of request packet length to response packet length, Size req Indicates the request packet length, Size res Indicates the length of the response packet.

8. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (5), weight allocation is performed, specifically: For the five valid feature values ​​F1~F5 in the domain name processing stage, a total weight of 0.6 is assigned; for the valid feature value of the isolated DNS request, that is, F6, a weight of 0.05 is assigned; for the QUIC fingerprint recognition whitelist detection result, that is, SC target,data , a weight of 0.15 is assigned; for the three valid eigenvalues ​​F7~F9 in the transmission stage, a weight of 0.2 is assigned.

9. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 8 is characterized in that: In step (5), calculate the detail judgment probability P tunnel The formula is: When P tunnel When >0.6, it is determined to be tunnel attack traffic.

Images