Covert communication detection method and system

Abstract

The invention discloses a covert communication detection method and system, and belongs to the technical field of network security, the covert communication detection system comprises five subsystems including a data packet capturing module, a protocol analysis module, a statistical rule module, a detection module and a response module, the data packet capturing module is responsible for acquiring a data packet flowing through from a network environment; and the protocol analysis module is responsible for deeply analyzing the data packet acquired by the data packet capturing module, and mining clues which may be hidden in the data packet and are abnormal or conform to a protocol level of covert communication characteristics. According to the method, by deeply knowing various characteristics, field meanings and normal use modes of the IP protocol, details that places such as the head, the data fragments and the option fields of the IP protocol are possibly utilized to construct hidden channels can be accurately analyzed, and hidden transmission behaviors can be found in time.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a covert communication detection method and system. Background Art

[0002] In many scenarios, there's a large amount of sensitive information that must be kept strictly confidential. Malicious attackers often use covert communication methods to bypass conventional security monitoring and secretly transmit this sensitive information to outsiders, causing significant losses to the parties involved. Covert communication detection can promptly detect and block such illegal data transmission, protecting the confidentiality and integrity of information.

[0003] The covert communication detection system is designed to use a series of technical means and analysis methods to identify abnormal communication behaviors hidden under the appearance of normal communication, ensure communication security, maintain network order, and protect sensitive information from illegal transmission. Traditional covert communication detection systems perform broad detection on multiple protocols and multiple possible hiding methods. Traditional systems based on behavioral analysis will observe behavioral patterns such as the resource usage of system processes and the frequency of network connections to determine whether there are hidden channels. However, this method may not be accurate enough in capturing the details of specific hiding methods under different protocols, and is prone to misjudgment or omission. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a covert communication detection method and system.

[0005] The technical solution adopted to solve the above technical problems is: a covert communication detection system, including five subsystems: a data packet capture module, a protocol analysis module, a statistical rule module, a detection module and a response module. The data packet capture module is responsible for obtaining data packets flowing through the network environment; the protocol analysis module is responsible for conducting in-depth analysis of the data packets obtained by the data packet capture module, and mining possible hidden anomalies or protocol-level clues that conform to the characteristics of covert communication; the statistical rule module formulates a series of statistical rules based on historical data and known normal communication patterns, and performs statistical analysis on the currently captured and analyzed communication data based on these rules; the detection module is responsible for conducting comprehensive and in-depth analysis and judgment of the communication data to determine whether there is covert communication behavior and its approximate characteristics and risk level; the response module is responsible for taking appropriate measures to respond.

[0006] The packet capture module sets the data packet to a promiscuous mode, works in the promiscuous mode by cooperating with the network interface card (NIC), and performs preliminary screening of the captured massive data packets according to preset basic filtering conditions, and stores the captured data packets in their entirety in the local cache.

[0007] The protocol analysis module analyzes the data of the data packet capture module in the initial stage, cooperates with the statistical rule module to form a rule set in the rule base, and is responsible for classifying the captured data packets according to protocol type during the system detection working stage.

[0008] The protocol analysis module adopts the IP protocol method for analysis. The protocol analysis module receives the original data packets transmitted by the data packet capture module and filters out the data packets that need to be analyzed by the IP protocol. At the same time, it performs a detailed analysis of the IP protocol header (IP corresponds to 0X0800) and sends the data after protocol analysis to the detection program of the IP protocol rule set for detection. If a hidden feature is detected, the signal is transmitted to the response module. If no hidden feature is detected, the data packet is diverted to the corresponding protocol analysis program for further protocol analysis after determining the upper layer protocol type.

[0009] The statistical rule module includes performing traffic statistical analysis on data packets, establishing traffic model parameters to form a traffic tree, and the statistical rule module also organizes the characteristic parameters of the mobile phone network system according to the analysis results of the protocol analysis module and refers to its protocol tree structure to form a rule base.

[0010] When constructing the traffic tree, it is necessary to store the statistical information of the overall network traffic in the root node, classify the data packets according to the protocol type, create corresponding child nodes for each protocol, and fill the traffic statistical data of the protocol type into the corresponding child nodes. For each protocol child node, it is further subdivided according to the source IP address segment, create the next layer of child nodes and record the traffic situation of the corresponding source IP address segment. This cycle continues until the pre-set branch depth is reached.

[0011] The detection module detects the results of the analysis by the protocol analysis module through the IP detection program and the TCP detection program to determine whether there is a hidden channel.

[0012] The specific steps include:

[0013] Step 1: Use a professional network sniffing tool to set up a listening port on a key network node and operate in promiscuous mode to ensure that all data packets passing through the node are captured. At the same time, collect system logs and application logs from servers and terminal devices on the network and pre-process the data.

[0014] Step 2: Focus on analyzing network protocol-related features for data packets. At the IP protocol level, check whether there are any anomalies in the source and destination IP addresses. Check whether the TTL (time to live) value in the IP protocol header conforms to the propagation pattern under normal network topology. Analyze the protocol fields to see if there are any uncommon or custom protocol values. For the TCP protocol, observe whether the three-way handshake and four-way handshake processes are standardized and whether there are any abnormal connection establishment and removal patterns. For the UDP protocol, count the communication frequency of specific source or destination ports. Abnormally high or low frequency port usage may involve covert communication.

[0015] Step 3: Determine whether covert communication exists based on a series of pre-established detection rules. Once suspicious covert communication behavior is detected, immediately alert relevant personnel through various means.

[0016] The beneficial effects of the present invention are as follows: Through an in-depth understanding of the various characteristics, field meanings and normal usage patterns of the IP protocol, the present invention can accurately analyze the details of the IP protocol header, data fragmentation, option fields, etc. that may be used to construct hidden channels, promptly discover such covert transmission behaviors, and block them before the information is successfully transmitted out of the target network, thereby preventing confidential information from being stolen and leaked to the outside, effectively protecting the data security of relevant organizations and individuals. The system can also deeply explore hidden features and provide more accurate traceability information. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a module schematic diagram of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0019] like Figure 1 As shown, a covert communication detection system of this embodiment includes five subsystems: a data packet capture module, a protocol analysis module, a statistical rule module, a detection module and a response module. The data packet capture module is responsible for acquiring data packets flowing through the network environment; the protocol analysis module is responsible for performing in-depth analysis on the data packets acquired by the data packet capture module, and mining for possible hidden anomalies or protocol-level clues that meet the characteristics of covert communication; the statistical rule module formulates a series of statistical rules based on historical data and known normal communication patterns, and performs statistical analysis on the currently captured and analyzed communication data based on these rules; the detection module is responsible for performing comprehensive and in-depth analysis and judgment on the communication data to determine whether there is covert communication behavior and its approximate characteristics and risk level; the response module is responsible for taking corresponding measures to respond.

[0020] The packet capture module sets the data packets to promiscuous mode, works in promiscuous mode by cooperating with the network interface card (NIC), and performs preliminary screening of the captured massive data packets according to the preset basic filtering conditions, and stores the captured data packets in their entirety in the local cache.

[0021] The protocol analysis module analyzes the data of the data packet capture module in the initial stage, cooperates with the statistical rule module to form a rule set in the rule base, and is responsible for classifying the captured data packets according to protocol type during the system detection working stage.

[0022] The protocol analysis module uses the IP protocol method for analysis. The protocol analysis module receives the original data packets passed by the data packet capture module and filters out the data packets that need to be analyzed by the IP protocol. At the same time, it performs a detailed analysis of the IP protocol header (IP corresponds to 0X0800) and sends the data after protocol analysis to the detection program of the IP protocol rule set for detection. If hidden features are detected, the signal will be transmitted to the response module. If no hidden features are detected, the data packet will be diverted to the corresponding protocol analysis program for further protocol analysis after determining the upper-layer protocol type.

[0023] The statistical rule module includes traffic statistical analysis of data packets, establishing traffic model parameters to form a traffic tree, and the statistical rule module also organizes the characteristic parameters of the mobile network system according to the analysis results of the protocol analysis module and refers to its protocol tree structure to form a rule base.

[0024] When constructing the traffic tree, the statistical information of the overall network traffic needs to be stored in the root node, the data packets are classified according to the protocol type, a corresponding child node is created for each protocol, and the traffic statistical data of the protocol type is filled into the corresponding child node. For each protocol child node, it is further subdivided according to the source IP address segment, and the next layer of child nodes is created and the traffic situation of the corresponding source IP address segment is recorded. This cycle continues until the pre-set branch depth is reached.

[0025] The detection module detects the results of the protocol analysis module through the IP detection program and the TCP detection program to determine whether there is a hidden channel.

[0026] The specific steps include:

[0027] Step 1: Use a professional network sniffing tool to set up a listening port on a key network node and operate in promiscuous mode to ensure that all data packets passing through the node are captured. At the same time, collect system logs and application logs from servers and terminal devices on the network and pre-process the data.

[0028] Step 2: Focus on analyzing network protocol-related features for data packets. At the IP protocol level, check whether there are any anomalies in the source and destination IP addresses. Check whether the TTL (time to live) value in the IP protocol header conforms to the propagation pattern under normal network topology. Analyze the protocol fields to see if there are any uncommon or custom protocol values. For the TCP protocol, observe whether the three-way handshake and four-way handshake processes are standardized and whether there are any abnormal connection establishment and removal patterns. For the UDP protocol, count the communication frequency of specific source or destination ports. Abnormally high or low frequency port usage may involve covert communication.

[0029] Step 3: Determine whether covert communication exists based on a series of pre-established detection rules. Once suspicious covert communication behavior is detected, immediately alert relevant personnel through various means.

[0030] The above are only preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention.

Claims

1. A covert communication detection system, characterized in that: It includes five subsystems: data packet capture module, protocol analysis module, statistical rule module, detection module and response module. The data packet capture module is responsible for obtaining data packets flowing through the network environment; the protocol analysis module is responsible for in-depth analysis of the data packets obtained by the data packet capture module, and mining the hidden anomalies or clues at the protocol level that meet the characteristics of covert communication; the statistical rule module formulates a series of statistical rules based on historical data and known normal communication modes, and performs statistical analysis on the currently captured and analyzed communication data based on these rules; the detection module is responsible for comprehensive and in-depth analysis and judgment of the communication data to determine whether there is covert communication behavior and its approximate characteristics and risk level; The response module is responsible for taking appropriate measures to respond.

2. A covert communication detection system according to claim 1, characterized in that: The packet capture module sets the data packet to a promiscuous mode, works in the promiscuous mode by cooperating with the network interface card (NIC), and performs preliminary screening of the captured massive data packets according to preset basic filtering conditions, and stores the captured data packets completely in the local cache.

3. A covert communication detection system according to claim 1, characterized in that: The protocol analysis module includes analyzing the data of the data packet capture module in the initial stage, cooperating with the statistical rule module to form a rule set in the rule base, and in the system detection working stage, is responsible for classifying the captured data packets according to the protocol type.

4. A covert communication detection system according to claim 3, characterized in that: The protocol analysis module adopts the IP protocol method for analysis. The protocol analysis module receives the original data packets transmitted by the data packet capture module and filters out the data packets that need to be analyzed by the IP protocol. At the same time, the IP protocol header is analyzed in detail (IP corresponds to 0X0800), and the data after protocol analysis is sent to the detection program of the IP protocol rule set for detection. If hidden features are detected, the signal is transmitted to the response module. If no hidden features are detected, the data packet is diverted to the corresponding protocol analysis program for further protocol analysis after determining the upper layer protocol type.

5. A covert communication detection system according to claim 1, characterized in that: The statistical rule module includes performing traffic statistical analysis on data packets and establishing traffic model parameters to form a traffic tree. The statistical rule module also organizes the characteristic parameters of the mobile network system according to the analysis results of the protocol analysis module and refers to its protocol tree structure to form a rule base.

6. A covert communication detection system according to claim 5, characterized in that: When constructing the traffic tree, it is necessary to store the statistical information of the overall network traffic in the root node, classify the data packets according to the protocol type, create corresponding child nodes for each protocol, and fill the traffic statistical data of the protocol type into the corresponding child nodes. For each protocol child node, it is further subdivided according to the source IP address segment, and the next layer of child nodes is created and the traffic situation of the corresponding source IP address segment is recorded. This cycle is repeated until a preset branch depth is reached.

7. A covert communication detection system according to claim 1, characterized in that: The detection module detects the analysis result of the protocol analysis module through the IP detection program and the TCP detection program to determine whether there is a hidden channel.

8. A method for covert communication detection according to any one of claims 1 to 7, characterized in that: The specific steps include: Step 1: Use professional network sniffing tools to set up listening ports on key network nodes and work in promiscuous mode to ensure that all data packets passing through the node can be captured. At the same time, collect system logs and application logs from servers and terminal devices in the network and pre-process the data. Step 2: Focus on analyzing the relevant features of the network protocol for the data packet. At the IP protocol level, check whether the source IP address and destination IP address are abnormal. Check whether the TTL (time to live) value of the IP protocol header conforms to the propagation law under the normal network topology. Analyze the protocol field to see whether there are uncommon or customized protocol values. For the TCP protocol, observe whether the three-way handshake and four-way handshake process are standardized and whether there are abnormal connection establishment and removal modes. For the UDP protocol, count the communication frequency of specific source or destination ports. Abnormally high or low frequency port usage involves covert communication. Step 3: Determine whether covert communication exists based on a series of pre-established detection rules. Once suspicious covert communication behavior is detected, immediately alert relevant personnel through various means.

Images