Ptunnel flow detection defense method of intelligent network card

Abstract

The invention discloses a Ptunnel flow detection and defense method of an intelligent network card. The detection and defense method comprises a data plane and a control plane, and periodically monitoring and counting the forwarded flow on the control plane of the network card, judging the I / O (Input / Output) condition of the flow, and intercepting the changed icmp flow. According to the method, Ptunnel flow detection and defense are achieved in the high-speed packet processing process of the DPU intelligent network card, and the method has the advantages that on one hand, specific attacks are defended and detected, on the other hand, normal flow forwarding is not affected, and a defense means which is completely unperceived by a user is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a Ptunnel flow detection and defense method for an intelligent network card. Background Art

[0002] With the development of the Internet, there are more and more important assets on the Internet, and network attacks are becoming more and more common. Network attacks and defenses are showing a trend of development in confrontation, especially in recent years with the rise of various encryption protocols, network attacks can disguise traffic into seemingly normal protocols. Among them, Ptunnel is a tool that disguises TCP / UDP traffic as ICMP traffic for forwarding. The technical principle of using Ptunnel to implement an attack is shown in the figure below. The Ptunnel client disguises TCP / UDP traffic, encapsulates it into the ICMP protocol, communicates with the opposite host, and completes the attack on the target server through the TCP / UDP traffic hidden in the ICMP tunnel.

[0003] The DPU smart network card is a network device that can provide a programmable and configurable hardware acceleration computing unit to improve forwarding performance and reduce the CPU load of the corresponding host. Developers can perform various functions on the DPU smart network card, such as network virtualization, load balancing, security encryption, and deep packet inspection. At a time when data center bandwidth is growing rapidly, the DPU smart network card can handle data volumes with larger bandwidths while taking into account certain programmable capabilities. On the other hand, it can also fully save valuable computing resources on the corresponding host. It is a new type of hardware with great economic benefits and development prospects.

[0004] The existing applications of DPU smart network cards are mainly concentrated in network virtualization, load balancing, security encryption, deep packet inspection, etc. In fact, combined with DPU smart network cards, developers can add more functions to traffic processing in a programmable way during the traffic processing process without affecting the normal forwarding of traffic. Summary of the invention

[0005] In view of the above problems, the present invention is proposed to provide a Ptunnel traffic detection and defense method for a smart network card that overcomes the above problems or at least partially solves the above problems.

[0006] According to one aspect of the present invention, a Ptunnel traffic detection and defense method for a smart network card is provided, the detection and defense method comprising: a data plane and a control plane;

[0007] The control plane of the network card periodically monitors and counts the forwarded traffic, determines the I / O status of the traffic, and intercepts the changed ICMP traffic.

[0008] Optionally, the control plane of the network card periodically monitors and counts the forwarded traffic to determine the I / O status of the traffic, specifically including:

[0009] The counter operation of rte_flow is used to maintain an icmp I / O statistics hash table in the control plane. The counter operation monitors the unloaded traffic and periodically compares it with the icmp I / O statistics hash table of the control plane.

[0010] Optionally, intercepting the changed icmp traffic specifically includes:

[0011] If there is suspicious icmp traffic, the traffic will be blocked by sending a drop operation to protect the network security of subsequent systems.

[0012] Optionally, the workflow of the data plane specifically includes:

[0013] When traffic arrives, it first enters the matching operation unit of the DPU smart network card for matching. When matching, it searches in the matching operation table of the fast channel. If there is a corresponding match in the matching operation table, the data packet will perform corresponding operations such as address translation on the smart network card and complete forwarding.

[0014] If the search in the matching operation table fails, the data packet of the current flow is sent to the control plane of the DPU smart network card, and is searched in the package processing program. If there is a corresponding processing rule in the flow connection table, the data packet performs the corresponding operation according to the connection information recorded in the flow connection table and completes the forwarding;

[0015] If the search in the flow connection table fails, the processing and forwarding of the first packet are completed in the software package processing program, and the corresponding processing and forwarding information is recorded in the flow connection table.

[0016] Optionally, the processing rules include hardware unloading, discarding, sampling, counting, and address conversion, and support operations on data packets in hardware high-speed forwarding scenarios.

[0017] Optionally, the workflow of the control plane includes:

[0018] For packets that arrive at the DPU smart NIC for the first time, they will first reach the control plane of the DPU smart NIC. The control plane is a DPDK development kit that implements protocol parsing of traffic in the DPDK software running state and sets judgment conditions. For example, when a specific IP address appears, a function is executed. If the uninstall function is executed, DPDK directly sends the corresponding uninstall rule to the DPU smart NIC on the control plane, and adds a counter action to the uninstall rule for counting.

[0019] When unloading, a record will be created in the flow connection table;

[0020] Periodically use the counter action to obtain the number of accesses to the data stream, calculate the access frequency, and update it to the corresponding traffic connection table;

[0021] During the update, the detection is performed based on the Ptunnel traffic detection method. For details, see the description of the Ptunnel traffic detection method.

[0022] If abnormal traffic is found, defense is performed based on the Ptunnel traffic defense method.

[0023] Optionally, the content of the record is: source IP, destination IP, source port, destination port, protocol, and an array of the access frequencies for the last five times.

[0024] Optionally, the Ptunnel traffic detection method specifically includes:

[0025] The detection period is T, and the variance of the access frequency is σ. By setting T and σ, real-time detection of Ptunnel traffic is achieved.

[0026] Optionally, the Ptunnel traffic defense method specifically includes:

[0027] The suspicious flow is directly sent to the drop operation, and the network card will not forward the current flow when it receives it later;

[0028] Slow forwarding is performed on the control plane, and all packets exceeding the specified speed are discarded.

[0029] The present invention provides a Ptunnel traffic detection and defense method for an intelligent network card, the detection and defense method comprising: a data plane and a control plane; a periodic monitoring and statistics of the forwarded traffic is performed on the control plane of the network card to determine the I / O status of the traffic, and the changed icmp traffic is intercepted. The detection and defense of Ptunnel traffic is realized during the high-speed packet processing of the DPU intelligent network card. The advantage of this method is that on the one hand, specific attacks are defended and detected, and on the other hand, normal traffic forwarding is not affected, so that a defense method is realized that is completely imperceptible to users.

[0030] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0032] Figure 1 A flowchart of a Ptunnel traffic detection and defense method for a smart network card provided by an embodiment of the present invention;

[0033] Figure 2 A schematic diagram of Ptunnel data packet characteristics provided by an embodiment of the present invention;

[0034] Figure 3 A schematic diagram of a device test provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0036] The terms "comprises" and "having" and any variations thereof in the description embodiments, claims and drawings of the present invention are intended to cover non-exclusive inclusions, for example, including a series of steps or units.

[0037] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0038] For Ptunnel traffic, we extracted the traffic pcap packets that used Ptunnel traffic to attack. The first half was normal icmp traffic, and the second half added malicious executable code to the traffic. We found that this type of traffic had very detailed characteristics in terms of I / O.

[0039] Therefore, the main method of detecting Ptunnel traffic is to detect the change of its transmission rate in timing. When a large change occurs in the timing I / O, it is determined that the traffic is not normal ICMP traffic. Ptunnel packet characteristics are as follows Figure 2 shown.

[0040] Implementing Ptunnel traffic monitoring on the DPU smart network card requires solving the problem of burst traffic monitoring in the unloaded state. It is known that the forwarding of data packets in the unloaded state is completely imperceptible. It is necessary to perform a periodic monitoring and statistics on the forwarded traffic on the control plane of the network card, and then determine the I / O status of the traffic and intercept the changed icmp traffic.

[0041] The counter operation of rte_flow is used to maintain an icmp I / O statistics hash table in the control plane. The counter operation monitors the unloaded traffic and periodically compares it with the icmp I / O statistics hash table of the control plane. When suspicious icmp traffic is found, the drop operation is sent to block the traffic, thereby protecting the network security of the subsequent system. Since all of this is implemented using the general interface of rte_flow, it will not affect the forwarding speed of the traffic, and the traffic can still be forwarded at line speed.

[0042] The present invention provides a Ptunnel traffic detection and defense method for a DPU intelligent network card, and ultimately realizes the detection and defense of Ptunnel traffic without affecting the line speed forwarding of the network card.

[0043] The flow chart of the method is as follows Figure 1 As shown, it includes two parts: data plane and control plane.

[0044] Data plane workflow, including:

[0045] When traffic arrives, it will first enter the matching operation unit of the DPU smart network card for matching. When matching, it will search in the matching operation table of the fast channel. If there is a corresponding match in the matching operation table, the data packet will perform corresponding address conversion and other operations on the smart network card and complete forwarding. This part of the operation is automatically performed by the hardware, but due to the relatively simple operation logic of the hardware, only some relatively simple matching operation functions can be implemented;

[0046] The introduction to the hardware device capabilities has included the fact that some operations are automatically performed by the hardware. However, due to the relatively simple operating logic of the hardware, only some relatively simple matching operation functions can be implemented as a supplement.

[0047] If the search fails in the matching operation table, the data packet of the flow is sent to the control plane of the DPU smart network card and searched in the package handler. If there is a corresponding processing rule in the flow connection table, the data packet will perform the corresponding operation and complete the forwarding according to the connection information recorded in the flow connection table. Common processing rules include hardware unloading, discarding, sampling, counting, address translation, etc., which support some simple operations on data packets in hardware high-speed forwarding scenarios;

[0048] If the search in the flow connection table fails, the processing and forwarding of the first packet will be completed in the software package handler, and the corresponding processing and forwarding information will be recorded in the flow connection table.

[0049] Control plane workflow, including:

[0050] For packets that arrive at the DPU smart NIC for the first time, they will first arrive at the control plane of the DPU smart NIC. The control plane is a DPDK development kit. In the DPDK software running state, the protocol parsing of the traffic can be implemented and some judgment conditions can be set. For example, when a specific IP address appears, a function is executed. If the uninstall function is executed, it means that DPDK directly sends the corresponding uninstall rule to the DPU smart NIC on the control plane, and adds a counter action to the uninstall rule for counting.

[0051] It is added that the control plane that will reach the DPU smart network card first is a DPDK development kit. In the DPDK software running state, the protocol analysis of the traffic can be realized, and some judgment conditions can be set. For example, when a specific IP address appears, a certain function is executed. If the uninstall function is executed, it means that DPDK directly sends the corresponding uninstall rules to the DPU smart network card on the control plane.

[0052] When unloading, a record will be created in the traffic connection table. The record content is: source IP, destination IP, source port, destination port, protocol, and the access frequency array of the last five times;

[0053] Periodically use the counter action to obtain the number of accesses to the data stream, calculate the access frequency, and update it to the corresponding traffic connection table;

[0054] When updating, the Ptunnel flow detection method is used. For details, see the description of the Ptunnel flow detection method. This method is used for detection.

[0055] Ptunnel traffic detection methods include:

[0056] Assuming that the detection period is T and the variance of the access frequency is σ (used to reflect the rate of change of traffic I / O), we can achieve real-time detection of Ptunnel traffic by setting T and σ. Specifically, a behavior baseline for regular traffic is set, and it is considered that tunnel traffic under this behavior baseline is normal tunnel communication. However, when traffic exceeding the set baseline appears, it is considered that the traffic is a malicious tunnel, that is, Ptunnel traffic.

[0057] If abnormal traffic is found, defense is performed based on the Ptunnel traffic defense method.

[0058] Ptunnel traffic defense methods include:

[0059] There are two ways to defend against Ptunnel traffic. The first is to directly send the drop operation for suspicious flows, and then the network card will not forward the flow when it receives it. The second is to perform slow forwarding on the control plane, and all packets exceeding the specified speed will be discarded.

[0060] Test environment construction and test methods, such as Figure 3 As shown:

[0061] Test environment configuration. In order to complete the test, a dedicated test instrument is used to send and receive packets. Ptunnel data packets are sent as test data sets.

[0062] Perform a loop operation on the DPU smart network card to return all received traffic to the instrument to verify whether the device will affect the line-speed forwarding of traffic.

[0063] Beneficial effect: The technical problem to be solved by the present invention is to realize the detection and defense of Ptunnel traffic during the high-speed packet processing of the DPU smart network card. The advantage of the present invention is that on the one hand, it can defend and detect specific attacks, and on the other hand, it does not affect the normal traffic forwarding, thereby realizing a defense method that is completely imperceptible to users.

[0064] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A Ptunnel traffic detection and defense method for a smart network card, characterized in that: The detection and defense method includes: a data plane and a control plane; The control plane of the network card periodically monitors and counts the forwarded traffic, determines the I / O status of the traffic, and intercepts the changed ICMP traffic.

2. The Ptunnel traffic detection and defense method of a smart network card according to claim 1 is characterized in that: The control plane of the network card periodically monitors and counts the forwarded traffic to determine the I / O status of the traffic, including: The counter operation of rte_flow is used to maintain an icmp I / O statistics hash table in the control plane. The counter operation monitors the unloaded traffic and periodically compares it with the icmp I / O statistics hash table of the control plane.

3. The Ptunnel traffic detection and defense method of a smart network card according to claim 1 is characterized in that: The interception of the changed icmp traffic specifically includes: If there is suspicious icmp traffic, the traffic will be blocked by sending a drop operation to protect the network security of subsequent systems.

4. The Ptunnel traffic detection and defense method of a smart network card according to claim 1, characterized in that: The workflow of the data plane specifically includes: When traffic arrives, it first enters the matching operation unit of the DPU smart network card for matching. When matching, it searches in the matching operation table of the fast channel. If there is a corresponding match in the matching operation table, the data packet will perform corresponding operations such as address translation on the smart network card and complete forwarding. If the search in the matching operation table fails, the data packet of the current flow is sent to the control plane of the DPU smart network card, and is searched in the package processing program. If there is a corresponding processing rule in the flow connection table, the data packet performs the corresponding operation according to the connection information recorded in the flow connection table and completes the forwarding; If the search in the flow connection table fails, the processing and forwarding of the first packet are completed in the software package processing program, and the corresponding processing and forwarding information is recorded in the flow connection table.

5. The Ptunnel traffic detection and defense method of a smart network card according to claim 4 is characterized in that: The processing rules include hardware unloading, discarding, sampling, counting, and address translation, and support operations on data packets in hardware high-speed forwarding scenarios.

6. The Ptunnel traffic detection and defense method of a smart network card according to claim 1, characterized in that: The workflow of the control plane includes: For packets that arrive at the DPU smart NIC for the first time, they will first reach the control plane of the DPU smart NIC. The control plane is a DPDK development kit that implements protocol parsing of traffic in the DPDK software running state and sets judgment conditions. For example, when a specific IP address appears, a function is executed. If the uninstall function is executed, DPDK directly sends the corresponding uninstall rule to the DPU smart NIC on the control plane, and adds a counter action to the uninstall rule for counting. When unloading, a record will be created in the flow connection table; Periodically use the counter action to obtain the number of accesses to the data stream, calculate the access frequency, and update it to the corresponding traffic connection table; During the update, the detection is performed based on the Ptunnel traffic detection method. For details, see the description of the Ptunnel traffic detection method. If abnormal traffic is found, defense is performed based on the Ptunnel traffic defense method.

7. A Ptunnel traffic detection and defense method for a smart network card according to claim 6, characterized in that: The content of the record is: source IP, destination IP, source port, destination port, protocol, and the access frequency array of the last five times.

8. The Ptunnel traffic detection and defense method of a smart network card according to claim 6, characterized in that: The Ptunnel flow detection method specifically includes: The detection period is T, and the variance of the access frequency is σ. By setting T and σ, real-time detection of Ptunnel traffic is achieved.

9. The Ptunnel traffic detection and defense method of a smart network card according to claim 6, characterized in that: The Ptunnel traffic defense method specifically includes: The suspicious flow is directly sent to the drop operation, and the network card will not forward the current flow when it receives it later; Slow forwarding is performed on the control plane, and all packets exceeding the specified speed are discarded.

Images