Port spoofing defense method and system based on eBPF and XDP technologies

Abstract

The invention provides a port spoofing defense method and system based on eBPF and XDP technologies, and relates to the technical field of network information security. The port spoofing defense method comprises the following steps: compiling an eBPF program and mounting the eBPF program to an XDP plane based on system call; when the port to be protected receives a traffic data packet, the XDP plane intercepts and scans the traffic data packet based on an eBPF technology, and identifies a scanning mode of the scanning traffic data packet; respectively constructing response strategies of TCP full-connection scanning, TCP semi-connection scanning, TCP covert scanning and UDP (User Datagram Protocol) scanning; and responding to the scanning traffic data packet based on the response strategy. According to the port spoofing defense method provided by the invention, the scanning data packet can be quickly and accurately identified and intercepted, the response packet is simulated to be replied or not replied, so that the scanner mistakenly delays that the closed port is open, and the attack rhythm of an attacker is delayed.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a port deception defense method and system based on eBPF and XDP technologies. Background Art

[0002] With the rapid development of network technology and the continuous expansion of network application scenarios, the means of network attackers have become more diverse and covert. Port scanning, as a key step in early detection, has been widely used in various malicious activities. In existing technologies, the protection against port scanning mainly relies on firewalls, intrusion detection systems (IDS) / intrusion prevention systems (IPS) and cloud security group technologies. However, in large networks, there are a large number of ports and complex application types. Firewalls and IDS / IPS rely on basic rule matching and simple filtering mechanisms. When faced with massive network traffic and diversified scanning data packets, they are unable to quickly and accurately identify and intercept scanning data packets targeting specific ports.

[0003] Therefore, it is urgent to provide a solution to solve the above problems. Summary of the invention

[0004] The purpose of the present invention is to provide a port spoofing defense method and system based on eBPF and XDP technology, which improves the shortcomings of the prior art that it is unable to quickly and accurately identify, intercept scanning data packets for specific ports and make simulated responses.

[0005] The present invention provides a port spoofing defense method based on eBPF and XDP technology, which adopts the following technical solution: Mount the eBPF program to the XDP plane; Intercept scanning traffic packets based on eBPF technology on the XDP plane; Construct a TCP full-connection scan response strategy based on the TCP full-connection scan method, construct a TCP half-connection scan response strategy based on the TCP half-connection scan method, construct a TCP covert scan response strategy based on the TCP covert scan method, and construct a UDP scan response strategy based on the UDP scan method; Respond to scanned traffic packets based on response policies.

[0006] Optionally, the process of mounting the eBPF program to the XDP plane includes: Compile the eBPF program and load the eBPF program into the kernel, and mount the eBPF program loaded into the kernel onto the XDP plane of the target network device based on the system call.

[0007] Optionally, in the process of intercepting scanning traffic packets based on the eBPF technology in the XDP plane, the following steps are included: When the port to be protected receives a traffic data packet, the XDP framework triggers the execution of the eBPF program, and determines whether the data packet is a scanning traffic data packet based on the predefined logic of the eBPF program. If the traffic data packet is a scanning traffic data packet, it will be intercepted and the scanning method of the scanning traffic data packet will be identified.

[0008] Optionally, the process of building a TCP full connection scan response strategy based on the TCP full connection scan mode includes: When a SYN scan message sent by TCP full connection scanning mode is received, the destination address and source IP address of the SYN scan message are swapped based on the eBPF program, and the ACK flag of the data packet is added. The sequence number seq and confirmation number ack of the data packet are set based on the response rule, and the modified TCP checksum of the data packet is calculated and replaced. The modified message is redirected to the network card based on the XDP plane and sent to the scanner.

[0009] Optionally, the process of building a TCP semi-connection scan response strategy based on the TCP semi-connection scan mode includes: When a SYN scan message sent by TCP semi-connection scanning is received, the destination address and source IP address of the SYN scan message are swapped based on the eBPF program, and the ACK flag of the data packet is added. The sequence number seq and confirmation number ack of the data packet are set based on the response rule. The modified message is redirected to the network card based on the XDP plane and sent to the scanner.

[0010] Optionally, the process of building a TCP covert scan response strategy based on the TCP covert scan method includes: When a scan message containing a special flag bit sent by a TCP covert scanning method is received, the scan data packet is directly discarded. The TCP covert scanning method includes FIN scanning, Xmas scanning, and NULL scanning.

[0011] Optionally, the process of constructing a UDP scan response strategy based on the UDP scan method includes: when a UDP scan message sent by the UDP scan method is received, the scan data packet is directly discarded.

[0012] Optionally, the process of responding to the scanned traffic data packet based on the response policy includes: The scanning mode of the scanning traffic data packet is identified based on eBPF, and the scanning traffic data packet is responded to based on the response strategy for different scanning modes.

[0013] In a second aspect of the present invention, a port spoofing defense system based on eBPF and XDP technology is provided, including a mounting module, an interception model, a policy module and a response module, wherein: The mount module is configured to mount the eBPF program to the XDP plane; The interception model is configured to intercept scanning traffic packets based on the eBPF technology on the XDP plane; Strategy module, builds TCP full connection scanning response strategy based on TCP full connection scanning mode, builds TCP half connection scanning response strategy based on TCP half connection scanning mode, builds TCP covert scanning response strategy based on TCP covert scanning mode, and builds UDP scanning response strategy based on UDP scanning mode; A response module is configured to respond to the scanning traffic data packet based on a response policy.

[0014] The present invention provides a port spoofing defense method and system based on eBPF and XDP technology, which has the following beneficial effects: 1. The present invention designs a complete and targeted processing strategy for different types of port scanning methods, including interception, field modification, simulated response and discard operations of scanning traffic data packets, which can flexibly simulate port responses to deceive port scanners; 2. Based on the eBPF program, the Ethernet, IP address and TCP header fields of the network data packet are precisely modified to deceive the scanner; 3. The present invention effectively deceives the port scanner by flexibly simulating the port response, which can slow down the attacker's attack rhythm, thereby improving the security and concealment of the network system without exposing the real port status. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flow chart of the port deception defense method provided by the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0017] The embodiment of the present invention provides a port spoofing defense method based on eBPF and XDP technology, see Figure 1 ,include: S1. Mount the eBPF program to the XDP plane. S2, intercept scanning traffic packets based on eBPF technology on the XDP plane; S3. Construct a TCP full connection scan response strategy based on the TCP full connection scan mode, construct a TCP half connection scan response strategy based on the TCP half connection scan mode, construct a TCP covert scan response strategy based on the TCP covert scan mode, and construct a UDP scan response strategy based on the UDP scan mode; S4. Respond to the scanned traffic data packet based on the response strategy.

[0018] In some embodiments, the process of executing step S1 to mount the eBPF program to the XDP plane includes: Compile the eBPF program and load the eBPF program into the kernel, and mount the eBPF program loaded into the kernel onto the XDP plane of the target network device based on the system call.

[0019] In fact, eBPF technology (Extended Berkeley Packet Filter) is an efficient bytecode virtual machine technology that can run in the Linux kernel. Developers can safely run custom code in the kernel space to process and analyze network data packets without modifying the kernel source code. It can also be mounted in multiple places in the kernel network stack to achieve precise control and monitoring of network traffic.

[0020] Furthermore, XDP technology (eXpress Data Path) is a high-performance network data path technology based on eBPF. It is located at the bottom layer of the network protocol stack and can process network data packets before they enter the kernel protocol stack, greatly improving the efficiency of data packet processing. It can quickly execute user-defined eBPF programs at the network interface driver layer to implement operations such as data packet filtering, modification, and forwarding.

[0021] In some embodiments, in executing step S2, the process of intercepting the scanning traffic data packet based on the eBPF technology on the XDP plane includes: When the port to be protected receives a traffic data packet, the XDP framework triggers the execution of the eBPF program, and determines whether the data packet is a scanning traffic data packet based on the predefined logic of the eBPF program. If the traffic data packet is a scanning traffic data packet, it will be intercepted and the scanning method of the scanning traffic data packet will be identified.

[0022] In some embodiments, the process of executing step S3 includes: S3.1. Construct TCP full connection scanning response strategy based on TCP full connection scanning method; S3.2, build TCP semi-connection scanning response strategy based on TCP semi-connection scanning method; S3.3, build TCP covert scanning response strategy based on TCP covert scanning method; S3.4. Construct a UDP scan response strategy based on the UDP scan method.

[0023] Specifically, in the process of executing step S3.1, building a TCP full connection scan response strategy based on the TCP full connection scan method includes: When a SYN scan message sent by TCP full connection scanning mode is received, the destination address and source IP address of the SYN scan message are swapped based on the eBPF program, and the ACK flag of the data packet is added. The sequence number seq and confirmation number ack of the data packet are set based on the response rule, and the modified TCP checksum of the data packet is calculated and replaced. The modified message is redirected to the network card based on the XDP plane and sent to the scanner.

[0024] In fact, the TCP full connection scanning method is the most basic TCP scanning method. The scanner attempts to establish a complete TCP three-way handshake connection with each port of the target host. If the connection can be successfully established, it means that the target port is open. By implementing the TCP full connection scanning response strategy, the scanner can believe that the target port is open, thereby performing the third handshake and sending a reset packet RST to disconnect.

[0025] Specifically, in the process of executing step S3.2, building a TCP semi-connection scanning response strategy based on the TCP semi-connection scanning method includes: When a SYN scan message sent by TCP semi-connection scanning is received, the destination address and source IP address of the SYN scan message are swapped based on the eBPF program, and the ACK flag of the data packet is added. The sequence number seq and confirmation number ack of the data packet are set based on the response rule. The modified message is redirected to the network card based on the XDP plane and sent to the scanner.

[0026] In fact, the TCP half-connection scanning method will send a SYN packet to the target port. When the target port is open, a SYN-ACK packet will be returned; otherwise, when the port is closed, a reset packet RST will be returned to disconnect. After receiving SYN-ACK, the scanner will not send ACK to complete the three-way handshake, but directly send RST packet to disconnect the connection, so that the port status can be detected without establishing a complete connection. The TCP half-connection scanning response strategy can make the scanner believe that the target port is open.

[0027] Specifically, in the process of executing step S3.3, building a TCP covert scanning response strategy based on the TCP covert scanning method includes: When a scan message containing a special flag bit sent by a TCP covert scanning method is received, the scan data packet is directly discarded. The TCP covert scanning method includes FIN scanning, Xmas scanning, and NULL scanning.

[0028] In fact, TCP covert scanning methods usually refer to scanning technologies that are designed to minimize the detection of the target system, such as FIN scanning, Xmas Tree scanning, Null scanning, etc. These scanning methods detect the port status by sending non-standard TCP data packets, such as packets with only the FIN flag or packets with multiple flags set at the same time, and judge whether the port is open based on the different responses of the target host to these abnormal data packets. The purpose of these scanning methods is to minimize the log information generated on the target host and avoid triggering firewall rules or intrusion detection system alarms. The TCP covert scanning response strategy can disguise the port as open.

[0029] Specifically, in the process of executing step S3.4, building a UDP scanning response strategy based on the UDP scanning method includes: when a UDP scanning message sent by the UDP scanning method is received, the scanning data packet is directly discarded.

[0030] In fact, UDP is a connectionless protocol. The scanner will send a UDP data packet to the target UDP port. If the target port is closed, it will usually return an ICMP message, indicating that the port is unreachable. If no response is received, it may be because the port is open or there is a network reason, such as a firewall filtering the ICMP message. The UDP scan response strategy can be used to disguise the port as open.

[0031] In some embodiments, in the process of executing step S4, responding to the scanned traffic data packet based on the response strategy includes: The scanning mode of the scanning traffic data packet is identified based on eBPF, and the scanning traffic data packet is responded to based on the response strategy for different scanning modes.

[0032] Furthermore, the subsequent traffic of the designated port is forwarded to the honeypot service, thereby achieving the purpose of active defense.

[0033] The embodiment of the present invention provides a port spoofing defense system based on eBPF and XDP technology, including a mounting module, an interception model, a policy module and a response module, wherein: The mount module is configured to mount the eBPF program to the XDP plane; The interception model is configured to intercept scanning traffic packets based on the eBPF technology on the XDP plane; Strategy module, builds TCP full connection scanning response strategy based on TCP full connection scanning mode, builds TCP half connection scanning response strategy based on TCP half connection scanning mode, builds TCP covert scanning response strategy based on TCP covert scanning mode, and builds UDP scanning response strategy based on UDP scanning mode; A response module is configured to respond to the scanning traffic data packet based on a response policy.

[0034] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A port spoofing defense method based on eBPF and XDP technology, characterized in that: The following steps are involved: Mount the eBPF program to the XDP plane; Intercept scanning traffic packets based on eBPF technology on the XDP plane; Construct a TCP full-connection scan response strategy based on the TCP full-connection scan method, construct a TCP half-connection scan response strategy based on the TCP half-connection scan method, construct a TCP covert scan response strategy based on the TCP covert scan method, and construct a UDP scan response strategy based on the UDP scan method; Respond to scanned traffic packets based on response policies.

2. According to a port spoofing defense method based on eBPF and XDP technology according to claim 1, it is characterized in that: The process of mounting the eBPF program to the XDP plane includes: Compile the eBPF program and load the eBPF program into the kernel, and mount the eBPF program loaded into the kernel onto the XDP plane of the target network device based on the system call.

3. According to a port spoofing defense method based on eBPF and XDP technology according to claim 1, it is characterized in that: The process of intercepting scanning traffic packets based on eBPF technology on the XDP plane includes: When the port to be protected receives a traffic data packet, the XDP framework triggers the execution of the eBPF program, and determines whether the data packet is a scanning traffic data packet based on the predefined logic of the eBPF program. If the traffic data packet is a scanning traffic data packet, it will be intercepted and the scanning method of the scanning traffic data packet will be identified.

4. According to a port spoofing defense method based on eBPF and XDP technology according to claim 1, it is characterized in that: The process of building a TCP full connection scan response strategy based on the TCP full connection scan method includes: When a SYN scan message sent by TCP full connection scanning mode is received, the destination address and source IP address of the SYN scan message are swapped based on the eBPF program, and the ACK flag of the data packet is added. The sequence number seq and confirmation number ack of the data packet are set based on the response rule, and the modified TCP checksum of the data packet is calculated and replaced. The modified message is redirected to the network card based on the XDP plane and sent to the scanner.

5. The port spoofing defense method based on eBPF and XDP technology according to claim 1 is characterized in that: The process of building a TCP semi-connection scan response strategy based on the TCP semi-connection scan method includes: When a SYN scan message sent by TCP semi-connection scanning is received, the destination address and source IP address of the SYN scan message are swapped based on the eBPF program, and the ACK flag of the data packet is added. The sequence number seq and confirmation number ack of the data packet are set based on the response rule. The modified message is redirected to the network card based on the XDP plane and sent to the scanner.

6. A port spoofing defense method based on eBPF and XDP technology according to claim 1, characterized in that: The process of building a TCP covert scan response strategy based on the TCP covert scan method includes: When a scan message containing a special flag bit sent by a TCP covert scanning method is received, the scan data packet is directly discarded. The TCP covert scanning method includes FIN scanning, Xmas scanning, and NULL scanning.

7. A port spoofing defense method based on eBPF and XDP technology according to claim 1, characterized in that: The process of building a UDP scanning response strategy based on the UDP scanning method includes: when a UDP scanning message sent by the UDP scanning method is received, the scanning data packet is directly discarded.

8. A port spoofing defense method based on eBPF and XDP technology according to claim 1, characterized in that: The process of responding to scanned traffic packets based on the response policy includes: The scanning mode of the scanning traffic data packet is identified based on eBPF, and the scanning traffic data packet is responded to based on the response strategy for different scanning modes.

9. A port spoofing defense system based on eBPF and XDP technology, characterized in that: It includes mounting module, interception model, strategy module and response module, among which: The mount module is configured to mount the eBPF program to the XDP plane; The interception model is configured to intercept scanning traffic packets based on the eBPF technology on the XDP plane; Strategy module, builds TCP full connection scanning response strategy based on TCP full connection scanning mode, builds TCP half connection scanning response strategy based on TCP half connection scanning mode, builds TCP covert scanning response strategy based on TCP covert scanning mode, and builds UDP scanning response strategy based on UDP scanning mode; A response module is configured to respond to the scanning traffic data packet based on a response policy.

Images