A doq tunneling attack detection method based on quic protocol extension

Abstract

The application discloses a DoQ tunnel attack detection method based on a QUIC protocol extension, and comprises the following steps: setting that the maximum length of a request packet sent by a host when using DNS over QUIC is not more than 512 bytes; in a domain name request stage, sending a domain name to be accessed in a plaintext form to a gateway for reporting, a detection mechanism arranged at the gateway stores and processes the domain name, and calculates an effective characteristic value; in a handshake stage, the detection mechanism firstly performs isolated DNS over QUIC request detection and calculates an effective characteristic value, then performs QUIC fingerprint identification whitelist detection on a primary handshake process, and calculates a similarity score; in a host transmission stage, the detection mechanism performs flow analysis on a transmitted request data packet, and calculates an effective characteristic value; and finally, the application performs weight distribution on all effective characteristic values and the detected similarity score, calculates a detail judgment probability, and finally judges whether it is tunnel attack flow. The application supports real-time DNS over QUIC tunnel attack detection, and can achieve good accuracy.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network security, and particularly relates to a DoQ (DNS over QUIC) tunnel attack detection method based on QUIC protocol extension. BACKGROUND

[0002] DNS tunneling is a technology that uses DNS protocol for data transmission, which allows non-DNS data to be embedded in DNS queries and responses. The conventional attack mode is as follows: the attacker controls at least one host in the local area network and at least one authoritative domain name server outside the local area network, and the controlled host initiates a DNS query, and the domain name of the purpose is the domain name governed by the authoritative domain name server controlled by the attacker. When DNS tunneling occurs, the DNS request packet transmits the local area network data to the authoritative domain name server, and the data is hidden, such as in the domain name. After receiving the DNS request packet, the authoritative domain name server sends a DNS response packet to the controlled host, which contains Command & Control instructions indicating the next operation of the controlled host and the data to be transmitted.

[0003] The reason why DNS tunneling attacks often succeed is that DNS requests are usually very frequent and the data volume is small, and conventional detection methods and detection methods are difficult to effectively identify DNS tunneling attack traffic. For example, when a user accesses a website each time, the browser will send a DNS request to resolve the domain name, and each DNS query usually involves only tens of bytes of query request and response. However, traditional data packets are usually used for large data transmission (such as web content, file transmission, etc.), and the size is usually larger than that of DNS packets, and the transmission frequency is lower. Therefore, with the popularization of DNS tunneling technology, the network security field is facing new challenges - most of the traditional traffic monitoring and detection methods are for low-frequency large data transmission, which often cannot effectively identify malicious activities hidden in DNS traffic. Therefore, studying the characteristics and detection methods of DNS tunneling has become an important topic in network security research.

[0004] In recent years, the detection methods of DNS tunneling attacks have also been constantly followed up, which can be divided into two categories: rule-based methods and model-based methods. For the former, it can be further divided into signature-based and threshold-based; for the latter, it can be divided into traditional machine learning and deep learning according to the feature extraction method and corresponding algorithm. At present, these DNS tunneling attack detection methods all have a core problem to solve, that is - which features to select as the judgment standard.

[0005] For feature extraction, such as IP, port number, frequency of packet transmission, ratio of upload and download volume of packet, length of packet, time elapsed between packet sending and receiving, etc. These features are widely used in various traffic analysis, and they can also be applied to DNS over QUIC tunnel attack detection, but relying only on these features will not be enough to effectively evaluate the probability of tunnel attack packets.

[0006] Although there are many studies on DNS tunnels at present, and many useful features have been extracted, either because they cannot handle ciphertext based on plaintext, or because the difference in the number of initial handshakes between HTTPS protocol and QUIC protocol greatly reduces the effectiveness of whitelist detection. SUMMARY

[0007] The application provides a DoQ tunnel attack detection method based on QUIC protocol extension, which supports real-time DNS over QUIC tunnel attack detection and can achieve good accuracy, fills the current blank of DNS over QUIC tunnel attack detection, and greatly reduces the risk of DNS over QUIC being used for tunnel attacks.

[0008] A DoQ tunnel attack detection method based on QUIC protocol extension, comprising the following steps:

[0009] (1) Set the maximum length of the request packet sent by the host when using DNS over QUIC to not more than 512 bytes;

[0010] (2) Before the host uses DNS over QUIC to request a domain name, send the domain name to be accessed in plaintext form to the gateway for reporting, and the detection mechanism deployed in the gateway stores and processes the domain name and calculates multiple effective feature values in the domain name processing stage;

[0011] (3) Before the host sends a DNS over QUIC request, perform initial handshake and enter the handshake stage; at this time, the detection mechanism deployed in the gateway first performs isolated DNS over QUIC request detection and calculates the effective feature values in the handshake stage; then perform QUIC fingerprint recognition whitelist detection on the initial handshake process and calculate the similarity score;

[0012] (4) After the host connection is established, start transmitting encrypted packets and enter the transmission stage; at this time, the detection mechanism performs traffic analysis on the transmitted request packets, and combines the subsequently received DNS over QUIC response packets to calculate the effective feature values in the transmission stage;

[0013] (5) The weight distribution is performed on all valid feature values of the domain name processing stage, the handshake stage and the host transmission stage and the similarity scores obtained by the QUIC fingerprint identification whitelist detection, and the detail determination probability P is further calculated tunnel Finally, it is determined whether it is tunnel attack traffic.

[0014] The application slightly expands the original QUIC protocol, introduces the DNS over QUIC request packet maximum packet length limit and domain name reporting mechanism. In addition, the application adopts the QUIC fingerprint identification whitelist detection, so that real-time DNS over QUIC tunnel attack detection can be supported, and good accuracy can be achieved.

[0015] In step (1), the application limits the maximum request data packet length for the following reasons:

[0016] (1-1) Considering that the QUIC protocol limits the maximum packet length, that is, the maximum packet length of the QUIC protocol under IPV6 is 1350 bytes, and the maximum packet length under IPV4 is 1370 bytes. However, it does not limit the maximum data packet size to be transmitted. When QUIC processes a large data packet exceeding the MTU (maximum transmission unit) limit, it does not directly fragment, but divides the data into smaller blocks through the flow mechanism. Each flow can be transmitted in parallel, so as to achieve the purpose of transmitting a large data packet exceeding the MTU limit. Assuming an extreme case, the controlled host transmits a large data packet when transmitting the request packet for the first time, and the data required by the attacker is all in this data packet. The existing detection mechanism will only consider this traffic as suspicious traffic at this stage, and further judgment is needed to wait for the response packet. At this time, whether the authoritative domain name server responds or not is irrelevant, because the attack purpose has been achieved. Even if the detection mechanism discovers that it is tunnel traffic, it is useless.

[0017] (1-2) Common DNS tunnel attack tools, such as iodine, dnscat2, DNSExfiltrator, etc., their purposes and the total transmission traffic required to achieve the attack purpose in a statistical sense are shown in Table 1. It can be observed that even with iodine, at least several KB of traffic (statistically significant total data packet transmission required to achieve the attack) is required. If the maximum packet length of the request data packet is not limited, the malicious user only needs a few, even one data packet to achieve the attack purpose. By limiting the maximum packet length of the request data packet, the malicious user needs more transmission times to achieve the attack purpose, and more transmission times will increase the probability of the tunnel attack traffic being discovered, thereby better helping the detection mechanism to detect tunnel traffic.

[0018] (1-3) The application observes that the size of normal DNS request packets is limited, according to the RFC 1035 protocol, the maximum length of the DNS domain name is 255 bytes, at the same time, the DNS message header is composed of a 12-byte header and four variable-length fields, and the packet header length of the QUIC message is up to 54 bytes. The size of the conventional DNS request packet is 60 bytes. According to the characteristics that the size of the conventional DNS request packet flow is smaller than the tunnel attack flow, the maximum request packet flow can be set to determine the upper threshold, which can increase the transmission frequency of the tunnel attack flow and will not affect the benign DNS over QUIC flow.

[0019] Table 1 Purpose and statistical significance of total transmission flow of common DNS tunnel attack tools

[0020] Tool Use Total transfer volume (statistically) Iodine C&C or file transfer Few KB to several MB dnscat2 Long time command and control communication Few tens of KB to several MB DNSExfiltrator Data leakage and file transfer Few MB to hundreds of MB

[0021] In step (1), the application sets 512 bytes as the upper limit of the data packet length for the following two reasons:

[0022] First, QUIC integrates TLS, and its encryption feature is that after encrypting the data, it will not significantly increase the length of the data packet. Therefore, 512 bytes will not affect the normal DNS over QUIC request packet, because even if a normal request packet that needs to request an extreme 255-byte domain name is encountered, a 12-byte DNS message header and a maximum 54-byte QUIC message packet header are used, and the maximum byte number of 512 can still ensure the smooth execution of the request.

[0023] Second, the traditional plaintext DNS protocol is transmitted by default using UDP, and for the purpose of optimizing transmission performance, the DNS protocol has a 512-byte limit. When the data length exceeds 512 bytes, the DNS protocol will use TCP protocol for fragmented transmission, because the default MTU of the router is usually 576 bytes. Considering that the application should be compatible with most network environments as much as possible, 512 bytes is set as the upper limit of the data packet length.

[0024] In step (2), the application considers that for DNS over QUIC encrypted data packets, it will be difficult to effectively identify tunnel attack flow only by the data packet header information such as IP and port number during data packet transmission, and the domain name feature is the most important feature in DNS tunnel attack, which often contains the information that the attacker wants to transmit, so the application will extend the DNS over QUIC protocol and add a domain name reporting mechanism. When the hosts in the local area network want to request the IP of the domain name, they will first report the domain name in plaintext to the gateway, and the detection mechanism deployed in the gateway will process the domain name.

[0025] In step (2), the detection mechanism deployed in the gateway stores and processes the domain name, including:

[0026] (2-1) A data table is maintained to record the domain names accessed by each host in the local area network and the number of accesses; when a host reports a domain name, the host name and the domain name are stored in the data table, and for the repeatedly accessed domain name, the number of times is incremented by 1. If the number of non-repeated domain names requested by a host exceeds 300, the probability of tunnel attack by the host will increase.

[0027] (2-2) The length of the domain name is calculated, and the proportion of special characters in the domain name is calculated. Because the proportion of special characters such as capital letters, numerical characters, and connection symbols in the encoded data of the DNS tunnel is higher, and the domain name will become longer in order to reduce repetition, both of them can be used as effective features.

[0028] (2-3) The entropy of the domain name characters is calculated. Normal domain names have readability and memorability, and follow Zipf's law, that is, a normal domain name should contain a small number of high-frequency characters and a large number of low-frequency characters, resulting in that the entropy of normal domain names is not high. However, the domain names of tunnel attacks are randomly generated, that is, the characters conform to random distribution, so that the character entropy of the tunnel attack domain name is higher than that of the normal domain name.

[0029] (2-4) The number of consecutive consonant characters in the domain name is calculated. When the number of consecutive consonant characters exceeds 4, the probability that the traffic packet is tunnel attack traffic will significantly increase, because only a small number of domain names will have 4 consecutive consonant characters, so the threshold of this invention is set to 4.

[0030] In step (2), the effective feature values of the domain name processing stage are calculated, specifically:

[0031] For the length of the subdomain name, the effective feature value F1 is calculated:

[0032] F1=D sub =D complete -D sec , D sec <D complete <256

[0033] Wherein, D complete is the length of the full domain name, D sec is the length of the second-level domain name, and D sub is the length of the subdomain name, that is, the part before the second-level domain name.

[0034] For the longest subdomain name, the effective feature value F2 is calculated:

[0035]

[0036] wherein D submax is the maximum length of the subdomain name set, M is the number of layers of the subdomain name, and D subi is the length of the i-th subdomain name;

[0037] For the continuous consonant character, the effective feature value F3 is calculated:

[0038]

[0039] wherein N represents the number of continuous consonant strings in the subdomain name, D consonanti is the length of the i-th continuous consonant string in the subdomain name, and the count() function is used to calculate D consonamti the number of characters with values greater than 4;

[0040] For the entropy of the domain name, the effective feature value F4 is calculated using the formula of Shannon information entropy:

[0041]

[0042] wherein n represents the number of non-repeated characters in the subdomain name, C i represents the i-th character in the subdomain name, P(C i ) represents the frequency of the i-th character in the entire string;

[0043] For the non-repeated domain name, the effective feature value F5 is calculated:

[0044] F5 = 1 / D pre

[0045] wherein D pre represents the number of domain names that have been accessed by the host in the data table, and if the domain name does not exist, the value is set to 1.

[0046] In step (3), the existing TLS fingerprint identification whitelist detection mechanism, such as Yue et al [Yue Wang, Anmin Zhou, Shan Liao, Rongfeng Zheng, Rong Hu, Lei Zhang, A comprehensive survey on DNS tunnel detection, Computer Networks, Volume 197, 2021, 108322, ISSN 1389-1286, https: / / doi.org / 10.1016 / j.comnet.2021.108322.], is only limited to DNS over HTTPS because the outermost packet is TLS, while the outermost packet of DNS over QUIC is QUIC, and QUIC only needs 1 time of handshake because it is embedded with TLS, while the handshake of HTTPS needs a total of 7 times of handshake, which makes TLS fingerprint identification can obtain a large number of characteristics to form an effective fingerprint, so when the existing TLS fingerprint identification whitelist detection mechanism is migrated to DNS over QUIC, its effect will be greatly reduced. But this mechanism is still a relatively effective detection method, so the present application decides to use the QUIC fingerprint identification whitelist detection mechanism, but the final similarity score generated will be given less weight.

[0047] In addition, thanks to the long-term wide popularity of TLS fingerprint identification, there are already many relatively complete TLS fingerprint identification sharing databases, so that the relatively complete data on the network can be directly used for TLS fingerprint identification whitelist detection, while QUIC has appeared for a short time, so the sharing database for QUIC fingerprint identification is relatively scarce, and the existing sharing database on the network cannot be used immediately, so the present application will first collect QUIC fingerprint identification data to establish a relatively complete database for DNS over QUIC traffic, so as to help the detection of DNS over QUIC tunnel attacks in the future.

[0048] In step (3), the present application will perform the following operations:

[0049] (3-1) Calculate the effective characteristic value in the handshake phase, specifically:

[0050] Monitor the isolated DNS over QUIC request, and the detection mechanism will maintain a data table, and take out the isolated DNS over QUIC request value Num orphan , and set the effective characteristic value F6:

[0051]

[0052] After that, let Num orphan = F6, and write back the data table.

[0053] (3-2) QUIC fingerprint whitelist detection is performed on the initial handshake process, and the similarity score is calculated, which is:

[0054] When the host performs the initial handshake of the DNS over QUIC protocol, the detection mechanism needs to collect the information in this stage, and extract the key features from the collected information; the extracted key features are used to form a specific hash value with a hash function, and then the hash value is converted into Similarity Digest (similarity feature summary), that is, QUIC fingerprint identification data, and then it is compared with the data in the collected QUIC fingerprint identification database, thereby extracting the final similarity score SC rarget,data .

[0055] Among them, the key features include QUIC version (QUIC version supported by the client and server, such as QUIC v1), connection ID (QUIC uses connection ID to identify a specific connection, which can help track the state and mode of the connection), TLS version (QUIC usually uses TLS1.3 to encrypt data, and extracting the TLS version helps to identify the encryption mechanism), encryption suite (list of encryption algorithms negotiated by the client and server. Different services may use different encryption suites), extension field (ServerName Indication and Application-Layer Protocol Negotiation fields, which help to further identify the application layer protocol), random number (client and server generated random number in TLS handshake, which helps to generate a unique connection identifier), flow control information, packet size, flow ID and other information.

[0056] In step (4), the deployed detection mechanism needs to perform the following operations:

[0057] (4-1) Collect the number of data packets, request packet length and response packet length, and calculate the ratio of request packet length / response packet length. Because the request packet of the tunnel attack needs to transmit data, its length will be longer than that of the normal request packet, so that the ratio will decrease, in addition, because of the need to transmit data, the sending frequency of the tunnel attack request will be larger than that of the normal request packet, which will be reflected on the gateway as the number of data packets increases, so both of them can be used as effective judgment features.

[0058] (4-2) record the time of request packet passing through the gateway and the time of response packet passing through the gateway, and calculate the time of intermediate experience. But this time is only stored and not used as a basis for determination. The reason is analyzed as follows: the domain names accessed by general users are mostly popular domain names, and such domain names have a high probability of being cached in the recursive resolver. Then when users access these domain names, the recursive resolver directly takes out from the Cache and returns to the host. In this case, the time between the request packet and the response packet is relatively short. In order to make the DNS tunneling attack work, the recursive resolver cache must not hit, which makes the time between the request packet and the response packet longer. Then it is inferred that the data packet with long time is more likely to be tunneling attack traffic. But normal authoritative domain name servers may need to interact with multiple authoritative domain name servers, i.e. let the recursive resolver find other authoritative domain name servers, each query needs a certain time, thereby affecting the overall response time. The controlled authoritative domain name server does not need to interact, so it will directly send a response packet, thereby making the time between the request packet and the response packet shorter. Based on the above two conflicting situations, the time parameter is only collected, but not used as one of the determination bases when detecting.

[0059] In step (4), the effective feature value of the transmission stage is calculated, specifically:

[0060] For the request packet length, the effective feature value F7 is calculated:

[0061] F7 = Size req / 60

[0062] Where Size req is the request packet length, and 60 bytes is a statistical value obtained according to the normal DNS request packet size;

[0063] For the number of data packets, the effective feature value F8 is calculated:

[0064] F8 = Num package

[0065] Where Num package is the number of data packets;

[0066] For the relationship between the request packet length and the response packet length, the effective feature value F9 is calculated:

[0067] F9 = Ratio req / res = Size req / Size res

[0068] Where Ratio req / res represents the ratio of request packet length / response packet length, Sizereq denotes the length of the request packet, Size res denotes the length of the response packet.

[0069] In step (5), weight distribution is performed, specifically:

[0070] For the five effective feature values F1-F5 of the domain name processing stage, a total of 0.6 weights are allocated; for the effective feature value of the isolated DNS request, that is, F6, 0.05 weights are allocated; for the QUIC fingerprint identification whitelist detection result, that is, SC target，data , 0.15 weights are allocated; for the three effective feature values F7-F9 of the transmission stage, 0.2 weights are allocated.

[0071] The formula for calculating the detail judgment probability P tunnel is as follows:

[0072]

[0073] When P tunnel >0.6, it is determined to be tunnel attack traffic.

[0074] Compared with the prior art, the present application has the following beneficial effects:

[0075] 1. The present application fills the blank of DNS over QUIC tunnel attack detection. Most of the existing works are for plaintext DNS or DNS over HTTPS, and these existing methods are difficult to deal with DNS over QUIC tunnel attack mode.

[0076] 2. The present application can be deployed in the gateway for real-time detection. Most of the existing schemes, especially those using machine learning, are difficult to be deployed in real time because the response time of AI is much longer than that of code mechanism, so in a network with high throughput, AI is difficult to be deployed in real time.

[0077] 3. Compared with the tunnel attack detection method using machine learning model, the present application has high robustness and defense ability. The training of AI model needs a large amount of sample data, and it is difficult for the laboratory to collect these data locally, and there are few large authentication organizations that publicly disclose DNS data, so the laboratory using machine learning scheme often uses the shared data on the network to train the model. At this time, researchers cannot effectively distinguish whether this data has been maliciously injected, and the model trained with this data is vulnerable to backdoor attacks, and the detection mechanism deployed by the present application will not have such problems. DETAILED DESCRIPTION OF DRAWINGS

[0078] Figure 1 are two DNS model diagrams.

[0079] Figure 2 A flow chart of a DoQ tunnel attack detection method based on QUIC protocol extension is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0080] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be noted that the following embodiments are intended to facilitate the understanding of the present application and do not limit the present application in any way.

[0081] The present application needs to determine the model to be studied. There are two relatively common models at present, as shown in Figure 1 Most of the existing technical papers are based on the model under the first condition, i.e., there is a DNS recursive resolver in the local area network, but this condition mostly exists in organizations such as enterprises. If it is for more general conditions such as home, like the second model, because of the lack of DNS recursive resolver, many features will be difficult to obtain. In order to better adapt to the changes brought by DNS over QUIC and make the resulting scheme more universal, the present application will take the second model as the research object.

[0082] After the model is determined, the research target of the present application is as follows: on the basis of the second model, by deploying a DNS over QUIC tunnel attack detection mechanism in the gateway, when there is a DNS over QUIC data packet passing through the gateway, this mechanism can analyze the traffic according to the overall data packet situation and evaluate the probability that the data packet is a tunnel attack packet, so as to efficiently distinguish whether the traffic is malicious tunnel traffic.

[0083] As shown in Figure 2 A DoQ tunnel attack detection method based on QUIC protocol extension, comprising the following steps:

[0084] Step S1, detecting the QUIC protocol before sending the DNS over QUIC data packet.

[0085] 1) Detect whether the port is 853, because according to the RFC 9250 protocol, by default, the DNS client using DNS over QUIC with a certain server must establish a QUIC connection with the UDP port 853 of the server, unless it has agreed with the server to use another port. And the default port number will not change before the data packet is sent, so whether it is DNS over QUIC traffic can be determined according to the port number.

[0086] 2) If the port number is 853, the protocol should continue to check the DNS message ID and the length of the packet. Because the RFC 9250 protocol stipulates that when a DNS query is sent via a QUIC connection, the DNS message ID must be set to 0. For a packet with a message ID = 0, if its length exceeds 512 bytes, an error code DOQ_EXCESSIVE_LOAD with a value of 0x4 should be returned to the host. This error code indicates that the request packet load is excessive and needs to be re-requested.

[0087] Step S2, before the host performs the QUIC handshake, the host needs to send the domain name in plaintext to the gateway for reporting, at this time, the detection mechanism deployed in the gateway stores and processes the domain name, and calculates a plurality of effective feature values in the domain name processing stage.

[0088] The present application defines the following symbols in the domain name processing and gives them corresponding meanings: the length of the full domain name D complete , the length of the second-level domain name D sec , the length of the subdomain (i.e. the part before the second-level domain name) D sub , the length of the i-th subdomain D subi , the number of layers of the subdomain M, the maximum value of the length in the subdomain set D submax , the length of the continuous consonant string in the subdomain D consonant , the length of the i-th continuous consonant string in the subdomain D consonanti , the number of continuous consonant strings in the subdomain N, the i-th character in the subdomain C i , the frequency of the i-th character in the subdomain in the entire string P(C i ), the number of non-repeating characters in the subdomain n, the number of domain names accessed by the host in the data table D pre (if this domain name does not exist, this value is set to 1), the unit of the above length is byte.

[0089] The detailed operation in the domain name processing of the present application is as follows:

[0090] 1) For the length of the subdomain, calculate the effective feature value F1:

[0091] F1 = D sub = D complete -D sec , D sec <D complete <256

[0092] 2) For the longest subdomain, calculate the effective feature value F2:

[0093]

[0094] 3) For continuous consonant characters, calculate the effective feature value F3:

[0095]

[0096] 4) For the entropy of the domain name, the effective feature value F4 is calculated by using the formula of Shannon information entropy:

[0097]

[0098] Wherein, 26 English characters, 10 digits, and separators are not counted in statistics, so there are 26+10=36 as the upper limit of summation, and thus 0

[0099] 5) For non-repeating domain names, calculate the effective feature value F5:

[0100] F5=1 / D pre

[0101] 6) Store the domain name in the data table for future tunnel attack detection.

[0102] Step S3, in the handshake phase of the host, the detection mechanism deployed in the gateway first detects the isolated DNS over QUIC request and calculates the effective feature value in the handshake phase; then, the initial handshake process is detected by the QUIC fingerprint recognition whitelist, and the similarity score is calculated.

[0103] The application will define the following symbols and give them corresponding meanings:

[0104] QUIC version E QUIC , connection ID ID connection , TLS version E TLS , encryption suite T encryption , extension field C extension , random number Num random , flow control information M control , packet size L package , flow ID ID flow , structure S handshake , hash value H of handshake handshake , isolated DNS over QUIC request value Num in the data table maintained by the gateway irphan , the i-th Bloom filter BF i , Similarity Digest SD of the packet target , Similarity Digest SD of the data in the QUIC fingerprint recognition database data , the number of features of the packet N targetN, the number of features of data in the QUIC fingerprinting database data Num, the number of sub-hashes subHash Size, the size of Bloom filters Bloom filters Num, the maximum number of features inserted in Bloom filters maxBloom filters SC, the similarity score between i and j data i，j Num, the number of Bloom filters Bloom filters Num, the number of Bloom filters in data packets targetBloom filters Num, the number of Bloom filters of data in the QUIC fingerprinting database dataBloom filters HS, the Hamming Similarity between the i-th Bloom filter and the j-th Bloom filter i，j .

[0105] The detection mechanism deployed in the gateway should perform the following detailed operations in the handshake phase:

[0106] 1) For isolated DNS over QUIC requests, take Num irphan from the data table, and set up the valid feature value F6:

[0107]

[0108] After that, let Num irphan =F6, and write back to the data table;

[0109] 2) For the interaction information in the handshake phase, collect E QUIC , ID connection , E TLS , T encryption , C extension , Num random , M control , L package , ID flow , etc. Let S handshake ={E QUIC , ID connection , E TLs , T encryption , C extension , Num random , M control , L package , ID flow}, and calculate the hash value H handshake =SHA1(S handshake );

[0110] 3) Convert the hash value to Similarity Digest for operation. Because the generated H handshake is 160 bits long, the present application will split H handshake into 5 32-bit sub-hashes, at which time Num subHash = 5. Each sub-hash is considered as a different hash value, while its 11 least significant bits are used as an index in the Bloom filters bit array, and these features will be inserted into 256-byte Bloom filters (Size Bloom filters = 256 x 8 = 2048 = 2^11). The capacity of a single Bloom filter is fixed at 128 features, and when the capacity of the Bloom filter is reached, a new Bloom filter will be created, and so on until all features are represented. Thus, we can calculate the Similarity Digest SD data generated by the handshake data as follows:

[0111]

[0112] 4) Calculate the similarity of the data in the handshake phase with the data in the collected QUIC fingerprint database using Hamming Similarity (HS). The Hamming Similarity (HS) formula is as follows:

[0113]

[0114] where n i is the number of features of BF i , e i，j is the number of bits set to 1 in BF i and BF j , i.e. the intersection of the two, E max is the maximum number of matching bits, E min is the minimum number of matching bits, N min is the minimum number of features in the Bloom filters required to calculate the HS value, and t c is a threshold value, and if it is below this threshold value, then any match is considered to be a coincidence, and t c is calculated as follows:

[0115] t c = 0.25 * (E max - E min ) + E min

[0116] 5) After obtaining HS, we can calculate the similarity score SC between the captured data packet and the data in the QUIC fingerprint identification database target，data :

[0117]

[0118] 6) For SC target，data , if SC target，data > 21, the detection mechanism considers that the two are highly similar, that is, the current handshake data packet is within the whitelist, and the probability of being a tunnel attack packet is reduced. On the contrary, the probability of being a tunnel attack packet increases.

[0119] Step S4, host transmission stage, the detection mechanism performs traffic analysis on the transmitted request data packet, and combines the subsequently received DNS over QUIC response packet to calculate the effective feature value of the transmission stage.

[0120] The present application will define the following symbols and assign them corresponding meanings: data packet number Num package , request packet length Size req , response packet length Size res , request packet length / response packet length ratio Ratio req / res , the unit of the above length is byte;

[0121] 1) For the request packet length, calculate the effective feature value F7:

[0122] F7 = Size req / 60

[0123] Where 60 bytes is a statistical value obtained according to the normal DNS request packet size, that is, the normal DNS request packet size should be around 60 bytes.

[0124] 2) For the number of data packets, calculate the effective feature value F8:

[0125] F8 = Num package

[0126] 3) For the relationship between the request packet length and the response packet length, calculate the effective feature value F9:

[0127] F9 = Ratio req / res = Size req / Size res

[0128] Step S5, weight assignment is performed on all effective feature values and the similarity score obtained by the QUIC fingerprint identification whitelist detection, and the detail determination probability P tunnel is calculated, and finally it is determined whether it is tunnel attack traffic.

[0129] For the five valid feature values of the domain name processing stage, i.e. F1-F5, a total weight of 0.6 will be allocated; for the valid feature value of the isolated DNS request, i.e. F6, a weight of 0.05 will be allocated; for the QUIC fingerprint identification whitelist detection result, i.e. SC target，data , a weight of 0.15 will be allocated; for the three valid feature values of the transmission stage, i.e. F7-F9, a weight of 0.2 will be allocated.

[0130] The detail determination probability P tunnel The algorithm is as follows:

[0131]

[0132] To verify the effect of the designed scheme of the present application, the 13th Gen Intel(R) Core(TM) i5-1340 2.50 GHz, maximum running memory 16 GB, 10-core 16-thread computer is used for simulation experiment in this embodiment.

[0133] All 20322 pieces of benign flow data in [(2021). CIC-Bell-DNS-EXF-2021 Dataset. Accessed: Oct. 20, 2023. [Online]. Available: https: / / www.unb.ca / cic / datasets / dns-exf-2021.html] and 20000 pieces of malicious flow data constructed in the laboratory environment are used for experiment, and the detection mechanism deployed by the present application determines as follows:

[0134] 1) The maximum tunnel probability of benign flow is 0.6017061838622095;

[0135] 2) The minimum tunnel probability of malicious flow is 0.6314663669274182, the maximum tunnel probability is 0.9837955434188381, and the average tunnel probability is 0.8111350626397091.

[0136] Therefore, when P tunnel >0.6, the present application considers that this host transmits suspicious flow packets, which may conduct tunnel attacks, and sends warning information to the network administrator, notifying the name of this host and the risk of tunnel attack.

[0137] The following indicators are used for performance evaluation in this embodiment:

[0138]

[0139] Wherein, TP (True Positives) represents the number of correctly identified DNS over QUIC tunnel traffic, TN (True Negatives) represents the number of correctly identified legitimate traffic, FN (False Negatives) represents the number of misjudging DNS over QUIC tunnel traffic as legitimate traffic, and FP (False Positives) represents the number of misjudging legitimate traffic as DNS over QUIC tunnel traffic.

[0140] Because the present application uses Hamming Similarity to calculate the similarity score, it will also produce errors, A. Qasem et al [A. Qasem, S. Zhioua, and K. Makhlouf,

[0141] "Finding a needle in a haystack: The traffic analysis version," Proc. Privacy Enhancing Technologies, 2019. DOI: 10.2478 / popets 2019-0030. pointed out that the theoretical Recall = 1-0.139% = 0.99861, Precision = 0.98, and the weight ratio of the present application is 0.15, so the influence of this method in the present application is theoretically Recall = 0.15*0.99861 = 0.1497915, Precision = 0.98*0.15 = 0.147.

[0142] In summary, the performance indicators of the present application in the laboratory environment are shown in Table 2 below:

[0143] Table 2 Performance indicators of 40322 data in laboratory environment

[0144] Experimental value\index Accuracy Recall Precision Experimental value 0.987 0.993 0.981

[0145] The above results show that the present application can achieve high Accuracy, Recall, and Precision.

[0146] Here it can be observed that the three are not extremely close to 1.0, such as 0.999, considering an extreme case, that is, the content to be transmitted by the attacker is very small, and the commonly used size of the benign traffic request packet is 60 bytes, which can achieve the attack purpose. For this extreme case, the detection mechanism deployed by the present application will be difficult to identify, but the attack volume in the actual total tunnel attack volume is very low, so it does not affect the actual deployment of the present application.

[0147] The application fills the blank of DNS over QUIC tunnel attack detection. Most of the existing works are for plaintext DNS or DNS over HTTPS, and these existing methods are difficult to deal with the DNS over QUIC tunnel attack mode, and the detection mechanism deployed by the application can effectively detect the DNS over QUIC tunnel attack, thereby enhancing the overall security in the local area network.

[0148] The above embodiments have described the technical solutions and beneficial effects of the application in detail. It should be understood that the above description is only a specific embodiment of the application and is not used to limit the application. Any modification, supplement and equivalent replacement made within the principle range of the application shall be included in the protection scope of the application.

Claims

1. A DoQ tunnel attack detection method based on QUIC protocol extension, characterized in that: The following steps are involved: (1) Set the maximum length of the request packet sent by the host when using DNS over QUIC to no more than 512 bytes; (2) Before using DNS over QUIC to request a domain name, the host sends the domain name to be accessed in plain text to the gateway for reporting. The detection mechanism deployed at the gateway stores and processes the domain name and calculates multiple valid feature values ​​during the domain name processing phase. (3) Before the host sends a DNS over QUIC request, it performs an initial handshake and enters the handshake phase; At this point, the detection mechanism deployed at the gateway first detects isolated DNS over QUIC requests and calculates the effective feature values ​​of the handshake phase; Then perform QUIC fingerprint identification whitelist detection on the initial handshake process and calculate the similarity score; (4) After the host connection is established, the encrypted data packet begins to be transmitted, entering the transmission phase; At this point, the detection mechanism performs traffic analysis on the transmitted request data packet and, combined with the subsequently received DNS over QUIC response packet, calculates the effective feature value of the transmission phase; (5) All valid feature values ​​in the domain name processing stage, handshake stage, and host transmission stage and the similarity scores obtained by QUIC fingerprint recognition whitelist detection are weighted to further calculate the detail judgment probability P tunnel , and finally determine whether it is tunnel attack traffic.

2. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (2), the detection mechanism deployed at the gateway stores and processes the domain name, including: (2-1) Maintain a data table to record the domain names and the number of times each host in the LAN has visited. When a host reports a domain name, store the host name and domain name in the data table. For domain names that have been visited repeatedly, increase the number of times by 1. (2-2) Calculate the length of the domain name and the proportion of special characters in the domain name; (2-3) Calculate the entropy of domain name characters; (2-4) Count the number of consecutive consonant characters in a domain name.

3. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 2 is characterized in that: In step (2), multiple valid feature values ​​of the domain name processing stage are calculated, specifically: Calculate the effective feature value F1 based on the length of the subdomain: F1=D sub =D complete -D sec ,D sec <D complete <256 Among them, D complete is the length of the full domain name, D sec is the length of the second-level domain name, D sub The length of the subdomain, that is, the part before the second-level domain name; For the longest subdomain, calculate the effective feature value F2: Among them, D submax is the maximum length in the subdomain set, M is the number of subdomain layers, D subi is the length of the i-th subdomain; For continuous consonant characters, calculate the effective eigenvalue F3: Where N represents the number of consecutive consonant strings in the subdomain, D consonanti is the length of the i-th continuous consonant string in the subdomain, and the count() function is used to count D consonanti >4; For the entropy of the domain name, the Shannon information entropy formula is used to calculate the effective eigenvalue F4: Where n represents the number of non-repeated characters in the subdomain name, C i Indicates the i-th character in the subdomain, P(C i ) represents the frequency of occurrence of the i-th character in the subdomain in the entire string; For non-repeated domain names, calculate the effective feature value F5: F5=1 / D pre Among them, D pre Indicates the number of domain names that the host has visited that already exists in the data table. If the domain name does not exist, this value is set to 1.

4. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (3), the effective eigenvalues ​​of the handshake phase are calculated, specifically: Monitor isolated DNS over QUIC requests. The detection mechanism will maintain a data table and extract the isolated DNS over QUIC request value Num from the data table. orphan , set up the effective eigenvalue F6: After this, let Num orphan =F6 and write it back to the data table.

5. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (3), the QUIC fingerprint recognition whitelist detection is performed on the initial handshake process, and the similarity score is calculated, specifically: When the host performs the initial handshake of the DNS over QUIC protocol, the detection mechanism needs to collect information at this stage and extract key features from the collected information; The extracted key features are used to form a specific hash value using a hash function, and then the hash value is converted into a similarity feature summary, that is, QUIC fingerprint recognition data, which is then compared with the data in the collected QUIC fingerprint recognition database to extract the final similarity score SC of the two. target,data .

6. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 5 is characterized in that: Key features include QUIC version, connection ID, TLS version, cipher suite, extension field, random number, flow control information, packet size, and stream ID.

7. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1, characterized in that: In step (4), the effective eigenvalue of the transmission phase is calculated, specifically: Calculate the effective characteristic value F7 based on the request packet length: F7=Size req / 60 Among them, Size req is the request packet length. 60 bytes is the statistical value obtained based on the normal DNS request packet size. Calculate the effective characteristic value F8 based on the number of data packets: F8=Number package Among them, Num package is the number of packets; Based on the relationship between the request packet length and the response packet length, calculate the effective characteristic value F9: F9=Ratio req / res =Size req / Size res Among them, Ratio req / res Indicates the ratio of request packet length to response packet length, Size req Indicates the request packet length, Size res Indicates the length of the response packet.

8. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 1 is characterized in that: In step (5), weight distribution is performed, specifically: For the five valid feature values ​​F1 to F5 in the domain name processing stage, a total weight of 0.6 is assigned; for the valid feature value of the isolated DNS request, that is, F6, a weight of 0.05 is assigned; for the QUIC fingerprint recognition whitelist detection result, that is, SC target,data , a weight of 0.15 is assigned; for the three valid eigenvalues ​​F7~F9 in the transmission stage, a weight of 0.2 is assigned.

9. The DoQ tunnel attack detection method based on QUIC protocol extension according to claim 8, characterized in that: In step (5), calculate the detail judgment probability P tunnel The formula is: When P tunnel When the value is greater than 0.6, it is determined to be tunnel attack traffic.

Images