TCP simulation connection method, device and equipment

Abstract

The invention relates to the technical field of computers, in particular to a TCP simulation connection method, device and equipment. The invention discloses a TCP (Transmission Control Protocol) simulation connection method, which is applied to a server simulated by a network simulator, and comprises the following steps of: creating a semi-connection table data structure, and integrating a semi-connection table to the network simulator; and when a TCP connection request is received, establishing a connection with the client based on the semi-connection table simulation. According to the embodiment of the invention, the semi-connection table change in the TCP connection establishment process can be simulated more accurately, effective simulation of DDos attack and protection is realized on the basis of not influencing the original model, and deeper research on the DDos attack is facilitated. Wherein the semi-connection table is realized by utilizing the structure of the chained hash table, so that the searching efficiency can be obviously improved, the semi-connection information can still be quickly searched and updated under the condition of large-scale connection requests, and the occupation of a memory is effectively reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a TCP simulation connection method, device and equipment. Background Art

[0002] Existing network simulators are widely used in network protocol research, performance evaluation, network topology optimization, machine learning, big data, and the Internet of Things. They are also highly applicable in simulating IoV communication systems, enabling research on connection methods, network performance, communication links, and other aspects.

[0003] While the network simulator boasts powerful functions and modules, its implementation of the "three-way handshake" during Transmission Control Protocol (TCP) connection establishment is relatively simplistic, lacking the specific implementation and management of the half-connection table. This results in an inability to accurately simulate the intermediate state information during TCP connection establishment when simulating IoV-cloud communications, making it difficult to conduct effective attack and defense simulations.

[0004] Therefore, when simulating and establishing the Internet of Vehicles communication system, if a network simulator is used to implement the network topology, the problem of no semi-connection table structure in the TCP connection process will occur, making it difficult to conduct research on network security attacks and defenses. Summary of the Invention

[0005] The embodiment of the present invention provides a TCP simulation connection method, device and equipment, which are used to solve the problem in the prior art that the network simulator cannot simulate the handshake protocol in the TCP connection process.

[0006] In a first aspect, an embodiment of the present invention provides a TCP simulation connection method, which is applied to a server simulated by a network simulator, and includes: Creating a semi-connected table data structure and integrating the semi-connected table into a network simulator; When a TCP connection request is received, a connection with the client is simulated based on the semi-connection table.

[0007] Optionally, the creating of the semi-connected table data structure includes: Defining a structure of intermediate state information stored in a semi-connected table, wherein the structure of the intermediate state information includes at least a source address, a destination address, and a port number; The semi-connected table is implemented through a chain hash table structure, and the semi-connected table is encapsulated as a class with multiple external interfaces.

[0008] Optionally, simulating establishing a connection with the client based on the semi-connection table includes: Upon receiving a connection request packet sent by the client, extracting first data from the connection request packet; storing the first data in the semi-join table; A connection is established between the server and the client based on the first data stored in the semi-connected table.

[0009] Optionally, after extracting the first data from the connection request packet, the method further includes: Determining whether a source IP address in the first data is recorded in a blacklist pre-established for the semi-connection table; When it is determined that the source IP address included in the first data in the current connection request packet is recorded in the blacklist, the current connection request packet is discarded; When it is determined that the source IP address included in the first data in the current connection request packet is not recorded in the blacklist, determining whether the source IP address in the first data is recorded in the semi-connection table; When it is determined that the source IP address included in the first data in the current connection request packet does not exist in the semi-connection table, writing the source IP address into the semi-connection table; When it is determined that the source IP address included in the first data in the current connection request packet exists in the semi-connection table, the source IP address is counted by 1 and the data packet is forwarded.

[0010] Optionally, the blacklist is used to store clients whose frequency of sending connection request packets is higher than a preset frequency threshold.

[0011] Optionally, after determining that the source IP address included in the first data in the current connection request packet exists in the semi-connection table, the method further includes: Determine whether the number of connection request packets received from the source IP address reaches a preset threshold; When it is determined that the threshold is reached, the source IP address is added to a blacklist and the source IP address is removed from the semi-connection table.

[0012] Optionally, the method further comprises: simulating establishing a connection with the client based on the semi-connection table; When a connection completion notification or a connection termination notification is received, the first data corresponding to the client is determined in the semi-connection table and deleted.

[0013] In a second aspect, an embodiment of the present invention provides a TCP simulation connection device, the device comprising: Creating a module to create a semi-connected table data structure and integrate the semi-connected table into a network simulator; The connection module, when receiving a TCP connection request, simulates establishing a connection with the client based on the semi-connection table.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, including: at least one processor; and at least one memory in communication with the processor, wherein: The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method as described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any method described in the first aspect.

[0016] The embodiments of the present invention can more accurately simulate changes in the semi-connection table during TCP connection establishment, effectively simulating DDos attacks and protection without affecting the original model, facilitating deeper research into DDos attacks. The use of a chained hash table structure to implement the semi-connection table significantly improves search efficiency, ensuring rapid search and update of semi-connection information even under large-scale connection requests, while effectively reducing memory usage.

[0017] The semi-connected table protection and DDos attack detection programs built within the network modeler are highly scalable and reusable, meeting the simulation requirements of diverse scenarios. Data stored in the semi-connected table is also recorded to disk in real time, facilitating subsequent analysis and auditing, allowing for the study and improvement of appropriate protection measures.

[0018] The embodiment of the present invention simulates the Internet of Vehicles communication system through a network simulator, implements multiple network protocols and communication scenarios, and supports dynamic addition and deletion of network nodes, truly reproducing the dynamic network topology changes in the Internet of Vehicles communication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0020] Figure 1 FIG2 is a flowchart of a TCP simulation connection method provided by an embodiment of the present application; Figure 2FIG2 is a schematic diagram showing the structure of a TCP simulation connection device provided in an embodiment of the present application; Figure 3 Shown is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to better understand the technical solution of the present application, the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0022] It should be clear that the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0023] Existing network simulators are widely used in network protocol research, performance evaluation, network topology optimization, machine learning, big data, and the Internet of Things. They are also highly applicable in simulating IoV communication systems, enabling research on connection methods, network performance, communication links, and other aspects.

[0024] While the network simulator boasts powerful functions and modules, its implementation of the "three-way handshake" during TCP connection establishment is relatively simplistic, lacking the specific implementation and management of the semi-connection table. This results in an inability to accurately simulate the intermediate state information during TCP connection establishment when simulating IoV-cloud communications, making it difficult to conduct effective attack and defense simulations.

[0025] Therefore, when simulating and establishing the Internet of Vehicles communication system, if a network simulator is used to implement the network topology, the problem of no semi-connection table structure in the TCP connection process will occur, making it difficult to conduct research on network security attacks and defenses.

[0026] like Figure 1 As shown in FIG, a TCP simulation connection method provided by an embodiment of the present invention is applied to a server simulated by a network simulator. The network simulator can be specifically an NS-3 simulator. Figure 1 , the specific steps of the method include: S101: Create a semi-connected table data structure and integrate the semi-connected table into the network simulator.

[0027] Specifically, when creating the semi-connection table data structure, it is necessary to predefine the structure of the intermediate state information stored in the semi-connection table. The structure of the intermediate state information includes at least the source address, the destination address, and the port number.

[0028] The semi-connected table is implemented through a chained hash table structure and encapsulated as a class with multiple external interfaces. The established semi-connected table is integrated into the network simulator to simulate the server.

[0029] To integrate the semi-connection table into a network simulator, a custom code file must be added to the simulator's TCP module's wscript file, declaring the TCP module's dependency on the custom code. By modifying the bind function within the TCP connection, a semi-connection table structure is generated and maintained when the server node calls the listen function to initiate TCP communication. This allows the semi-connection table to be implemented in the client simulated by the network simulator whenever a new TCP connection is established.

[0030] S102: When a TCP connection request is received, a connection with the client is established based on the semi-connection table simulation.

[0031] Specifically, upon detecting the establishment of a new TCP connection and receiving a connection request packet sent by a client, the server extracts first data from the connection request packet, i.e., the semi-connection information corresponding to the client. The server stores the extracted first data in a semi-connection table, and continues monitoring other TCP connections. A connection is established between the server and the client based on the first data in the semi-connection table.

[0032] When a connection completion notification or a connection termination notification is received, the corresponding first data is searched in the semi-connection table and deleted.

[0033] In the embodiment of the present invention, the client may also be simulated by a network simulator.

[0034] Optionally, in some embodiments, when creating the semi-connection table, a blacklist is also established in the semi-connection table to store clients that send connection request packets at a frequency higher than a preset frequency to prevent them from causing malicious attacks on the server.

[0035] Specifically, after extracting the first data from the connection request packet, it is determined whether the source IP address in the first data has a record in the blacklist of the semi-connection table.

[0036] When it is determined that the source IP address included in the first data in the current connection request packet is recorded in the blacklist, the current connection request packet is directly discarded; when it is determined that the source IP address included in the first data in the current connection request packet is not recorded in the blacklist, it is further determined whether the source IP address exists in the semi-connection table.

[0037] When it is determined that the source IP address included in the first data of the current connection request packet does not exist in the semi-connection table, the source IP address and other first data are written into the semi-connection table; when it is determined that the source IP address included in the first data of the current connection request packet exists in the semi-connection table, the source IP address is counted by 1 and the current connection request packet is forwarded.

[0038] The system counts the number of connection request packets sent by the source IP address to determine whether the number has reached a preset threshold, thereby determining whether the server has launched a malicious attack. If the threshold is reached, the source IP address is added to the blacklist and removed from the semi-connection table.

[0039] Optionally, in some embodiments, a DDos attack can be simulated in a network simulator integrated with a semi-connected table. Specifically, a new attribute is added to the client to distinguish between normal nodes and attacking nodes. By modifying the DoConnect function, the attacking node is caused to repeatedly send connection request packets, and the attack is carried out by modifying the sequence number and port number and generating a virtual IP address.

[0040] The embodiments of the present invention can more accurately simulate changes in the semi-connection table during TCP connection establishment, effectively simulating DDos attacks and protection without affecting the original model, facilitating deeper research into DDos attacks. The use of a chained hash table structure to implement the semi-connection table significantly improves search efficiency, ensuring rapid search and update of semi-connection information even under large-scale connection requests, while effectively reducing memory usage.

[0041] The semi-connected table protection and DDos attack detection programs built within the network modeler are highly scalable and reusable, meeting the simulation requirements of diverse scenarios. Furthermore, data stored in the semi-connected table is recorded to disk files in real time, facilitating subsequent analysis and auditing, thereby enabling research and improvement of appropriate protection measures.

[0042] The embodiment of the present invention simulates the Internet of Vehicles communication system through a network simulator, implements multiple network protocols and communication scenarios, and supports dynamic addition and deletion of network nodes, truly reproducing the dynamic network topology changes in the Internet of Vehicles communication system.

[0043] Corresponding to the above TCP simulation connection method, the embodiment of the present application also provides a TCP simulation connection device, which can be an NS-3 network simulator. Figure 2 , is a structural diagram of a TCP simulation connection device provided in an embodiment of the present application. The TCP simulation connection device may include: a creation module 201 and a connection module 202.

[0044] A creation module 201 creates a semi-connected table data structure and integrates the semi-connected table into a network simulator; The connection module 202 simulates establishing a connection with the client based on the semi-connection table when receiving a TCP connection request.

[0045] Figure 3 This is a schematic diagram of the structure of an embodiment of the electronic device of this specification. Figure 3 As shown, the above-mentioned electronic device may include at least one processor; and at least one memory communicatively connected to the above-mentioned processing unit, wherein: the memory stores program instructions that can be executed by the processing unit, and the above-mentioned processor calls the above-mentioned program instructions to execute the TCP simulation connection method provided in this embodiment.

[0046] The electronic device can be a device capable of intelligently communicating with a user, such as a cloud server. The specific form of the electronic device is not limited in this specification. It is understood that the electronic device here is the machine mentioned in the method embodiment.

[0047] Figure 3 A block diagram is shown of an exemplary electronic device suitable for implementing embodiments of the present description. Figure 3 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of this specification.

[0048] like Figure 3 As shown, the electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, one or more processors 310, a communication interface 320, a memory 330, and a communication bus 340 connecting different system components (including the memory 330, the communication interface 320, and the processor 310).

[0049] Communication bus 340 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnection (PCI) bus.

[0050] Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, removable and non-removable media.

[0051] Memory 330 may include computer-readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The electronic device may further include other removable or non-removable, volatile or non-volatile computer storage media. Memory 330 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of various embodiments of this specification.

[0052] A program / utility having a set (at least one) of program modules may be stored in memory 330. Such program modules include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. The program modules generally implement the functions and / or methods of the embodiments described herein.

[0053] The processor 310 executes various functional applications and data processing by running the programs stored in the memory 330, such as implementing the TCP simulation connection method provided in the embodiment shown in this specification.

[0054] An embodiment of this specification provides a non-transitory computer-readable storage medium, which stores computer instructions. The computer instructions enable the computer to execute the TCP simulation connection method provided by the embodiment shown in this specification.

[0055] The non-transitory computer-readable storage medium may employ any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0056] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0057] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0058] Computer program code for performing the operations of this specification may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, and C++, as well as conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0059] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0060] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. Throughout this specification, "plurality" means at least two, such as two or three, unless otherwise specifically defined.

[0061] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of this specification includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of this specification belong.

[0062] The word "if," as used herein, may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to the determination" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)," depending on the context.

[0063] It should be noted that the terminals involved in the embodiments of this specification may include but are not limited to personal computers (Personal Computer; hereinafter referred to as: PC), personal digital assistants (Personal Digital Assistant; hereinafter referred to as: PDA), wireless handheld devices, tablet computers (Tablet Computer), mobile phones, MP3 players, MP4 players, etc.

[0064] In the embodiments provided in this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interface, indirect coupling or communication connection of the device or unit, which may be electrical, mechanical or other forms.

[0065] In addition, the functional units in the various embodiments of this specification may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional units.

[0066] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit stored in a storage medium includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute some of the steps of the method described in various embodiments of this specification.

[0067] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A TCP simulation connection method, characterized in that: The method is applied to a server simulated by a network simulator, and the method includes: Creating a semi-connected table data structure and integrating the semi-connected table into a network simulator; When a TCP connection request is received, a connection with the client is simulated based on the semi-connection table.

2. The method according to claim 1, characterized in that The step of creating a semi-connected table data structure includes: Defining a structure of intermediate state information stored in a semi-connected table, wherein the structure of the intermediate state information includes at least a source address, a destination address, and a port number; The semi-connected table is implemented through a chain hash table structure, and the semi-connected table is encapsulated as a class with multiple external interfaces.

3. The method according to claim 1, characterized in that The simulating establishment of a connection with the client based on the semi-connection table includes: Upon receiving a connection request packet sent by the client, extracting first data from the connection request packet; storing the first data in the semi-join table; A connection is established between the server and the client based on the first data stored in the semi-connected table.

4. The method according to claim 3, characterized in that After extracting the first data from the connection request packet, the method further includes: Determining whether a source IP address in the first data is recorded in a blacklist pre-established for the semi-connection table; When it is determined that the source IP address included in the first data in the current connection request packet is recorded in the blacklist, the current connection request packet is discarded; When it is determined that the source IP address included in the first data in the current connection request packet is not recorded in the blacklist, determining whether the source IP address in the first data is recorded in the semi-connection table; When it is determined that the source IP address included in the first data in the current connection request packet does not exist in the semi-connection table, writing the source IP address into the semi-connection table; When it is determined that the source IP address included in the first data in the current connection request packet exists in the semi-connection table, the source IP address is counted by 1 and the data packet is forwarded.

5. The method according to claim 4, characterized in that The blacklist is used to store clients that send connection request packets at a frequency higher than a preset frequency threshold.

6. The method according to claim 4, characterized in that After determining that the source IP address included in the first data in the current connection request packet exists in the semi-connection table, the method further includes: Determine whether the number of connection request packets received from the source IP address reaches a preset threshold; When it is determined that the threshold is reached, the source IP address is added to a blacklist and the source IP address is removed from the semi-connection table.

7. The method according to claim 1, characterized in that The method further comprises: simulating establishing a connection with the client based on the semi-connection table; When a connection completion notification or a connection termination notification is received, the first data corresponding to the client is determined in the semi-connection table and deleted.

8. A TCP simulation connection device, characterized in that: The device comprises: Creating a module to create a semi-connected table data structure and integrate the semi-connected table into a network simulator; The connection module, when receiving a TCP connection request, simulates establishing a connection with the client based on the semi-connection table.

9. An electronic device, characterized in that: include: at least one processor; as well as at least one memory in communication with the processor, wherein: The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

Images