Method, device and equipment for simulating TCP (Transmission Control Protocol) fingerprint according to process and medium

Abstract

The invention provides a TCP fingerprint simulation method and device according to a process, equipment and a medium. The method comprises the steps that calling of a tcpconnect kernel function is tracked through kprobe of an eBPF; if calling exists, the TC of the eBPF is used for capturing a TCP data packet which is about to be sent out; associating the process PID calling the function with the established TCP connection, and storing the process PID and the established TCP connection in a map of the eBPF; analyzing the TCP data packet to obtain an SYN message, obtaining a corresponding original fingerprint, and replacing the original fingerprint with a simulation fingerprint of a prefabricated template; the checksum of the TCP data packet is recalculated, then a new TCP data packet is assembled, and the new TCP data packet is sent out; according to the invention, TCP fingerprint simulation can be respectively carried out on different processes on the same equipment, and the simulation speed is high, so that the simulation efficiency is improved, and the normal TCP connection is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network communications, and in particular to a process-based TCP fingerprint simulation method, device, equipment and medium. Background Art

[0002] In network security and protocol analysis, TCP fingerprinting is a technique that identifies network devices or operating systems by analyzing specific characteristics of the TCP / IP protocol. These characteristics include, but are not limited to, the Initial Sequence Number (ISN), window size, and Maximum Segment Size (MSS) of TCP connections. By simulating these characteristics, security researchers and system administrators can identify specific devices or operating systems on a network, which is very useful for network diagnostics, vulnerability scanning, or intrusion detection.

[0003] The basic principle of TCP fingerprint simulation

[0004] Initial Sequence Number (ISN): Each TCP connection has a unique initial sequence number. Different operating systems and devices may use different algorithms to generate ISNs. For example, the ISNs generated by Linux and Windows systems may differ.

[0005] Window Size: The TCP window size reflects the size of the receiver's buffer. Different operating systems and network devices may have different default window size settings.

[0006] Maximum Segment Size (MSS): The MSS is the maximum amount of data that each TCP segment can carry in a TCP connection. Different network devices and operating systems may have different default MSS values.

[0007] In the existing technology, when modifying TCP fingerprints through fingerprint simulation, only all changes can be made on the same device. It is impossible to modify the corresponding TCP fingerprints according to different processes, such as changing the fingerprint of process A to Windows and process B to Mac. In addition, the existing TCP fingerprint simulation is slow and requires high hardware performance requirements. Otherwise, during the TCP fingerprint simulation process, the speed will be too slow, resulting in TCP connection failure. Summary of the Invention

[0008] The technical problem to be solved by the present invention is to provide a process-based TCP fingerprint simulation method, device, equipment and medium, which can perform TCP fingerprint simulation for different processes on the same device separately, and the simulation speed is fast, so that the simulation efficiency is improved and the normal TCP connection is guaranteed.

[0009] In a first aspect, the present invention provides a process-based TCP fingerprint simulation method, comprising the following steps:

[0010] Step 1, track the call of the tcp_connect kernel function through the kprobe of eBPF;

[0011] Step 2, if there is a call, use the TC of eBPF to capture the TCP packet about to be sent out;

[0012] Step 3, associate the process PID calling the function with the created TCP connection and store it in the map of eBPF;

[0013] Step 4, parse the TCP packet to obtain the SYN message, obtain the corresponding original fingerprint, and replace the original fingerprint with the simulated fingerprint of the prefabricated template;

[0014] Step 5, recalculate the checksum of the TCP packet, then assemble it into a new TCP packet, and send out the new TCP packet.

[0015] In a second aspect, the application provides a TCP fingerprint simulation device according to a process, comprising:

[0016] A tracking module for tracking the call of the tcp_connect kernel function through the kprobe of eBPF;

[0017] A capturing module for capturing the TCP packet about to be sent out using the TC of eBPF if there is a call;

[0018] An association module for associating the process PID calling the function with the created TCP connection and storing it in the map of eBPF;

[0019] A simulation module for parsing the TCP packet to obtain the SYN message, obtaining the corresponding original fingerprint, and replacing the original fingerprint with the simulated fingerprint of the prefabricated template;

[0020] A retransmission module for recalculating the checksum of the TCP packet, then assembling it into a new TCP packet, and sending out the new TCP packet.

[0021] In a third aspect, the application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of the first aspect when executing the program.

[0022] In a fourth aspect, the application provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executable by a processor to implement the method of the first aspect.

[0023] The one or more technical solutions provided by the application have at least the following technical effects or advantages:

[0024] 1. High performance

[0025] Kernel-mode operation: eBPF programs run directly in kernel mode, avoiding frequent switching between user and kernel modes and reducing context switching overhead. This makes packet processing highly efficient and enables rapid, real-time processing of large amounts of network traffic.

[0026] Zero copy: eBPF programs can directly operate on the memory of network packets without copying the packets from kernel space to user space, further reducing data transmission overhead and improving processing speed.

[0027] Parallel processing: eBPF programs can run in parallel on multiple CPU cores, fully utilizing the performance advantages of multi-core processors and further improving processing capabilities.

[0028] 2. Flexibility

[0029] Dynamic loading and updating: eBPF programs can be dynamically loaded and updated at runtime without restarting the system or network services. This allows for rapid adjustments to packet processing logic based on different needs, such as modifying fingerprint features or adjusting processing strategies.

[0030] Programmability: eBPF provides a powerful programming interface that allows developers to write complex logic to process network packets. For example, conditional judgments and modifications can be made based on specific fields in the packet (such as IP address, port number, protocol type, etc.) to achieve customized network behavior.

[0031] 3. Security

[0032] Kernel protection mechanism: eBPF programs run in the restricted environment of the kernel, which strictly restricts program execution to prevent malicious code from damaging the system. For example, eBPF programs cannot directly access sensitive kernel data or perform illegal operations.

[0033] Fine-grained control: eBPF enables fine-grained control of network packets, such as modifying only specific types of traffic or traffic from specific sources, thereby reducing the impact on normal network communications.

[0034] 4. Low latency

[0035] Direct packet manipulation: eBPF programs can operate directly on the packet transmission path without passing the packet to user-mode programs for processing, reducing packet processing latency. This is very helpful for application scenarios that require low latency, such as real-time network monitoring and high-performance network services.

[0036] 5. Low resource consumption

[0037] Lightweight: eBPF programs typically have small code size and low resource consumption. Compared with traditional user-space network processing programs, eBPF programs do not need complex thread management, memory allocation, etc., so they occupy less system resources.

[0038] Efficient use of system resources: Since eBPF programs run directly in the kernel, they can fully utilize various optimization mechanisms provided by the kernel (such as cache, DMA, etc.), further improving resource utilization efficiency.

[0039] 6. Integration with existing systems

[0040] Seamless integration: eBPF programs can be seamlessly integrated into existing Linux network stacks without major modifications to the kernel or network services. This makes it easy to apply eBPF technology to existing network systems for functional expansion or performance optimization.

[0041] Strong compatibility: eBPF programs can work with existing network protocols and tools (such as TCP / IP, iptables, etc.), without disrupting existing network architectures.

[0042] In summary, the application can simulate TCP fingerprints for different processes on the same device respectively, and the simulation speed is fast, which improves the simulation efficiency and ensures normal TCP connection.

[0043] The above description is only a summary of the technical solutions of the application. In order to more clearly understand the technical means of the application, the application can be implemented according to the content of the specification, and in order to make the above and other purposes, features and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described. BRIEF DESCRIPTION OF DRAWINGS

[0044] The application will be further described below with reference to the accompanying drawings and embodiments.

[0045] Figure 1 The flowchart in the method of the embodiment of the application is shown.

[0046] Figure 2 The structure diagram of the device in the embodiment of the application is shown. DETAILED DESCRIPTION

[0047] The embodiments of the application provide a TCP fingerprint simulation method, device, equipment and medium according to processes, which has high processing speed and is convenient for users to use.

[0048] The technical solutions in the embodiments of the application have the following general ideas:

[0049] When the Linux kernel network protocol stack processes network data packets, the data packets themselves do not carry information such as the corresponding process PID;

[0050] 1. Using eBPF technology, monitor the TCP_connect function in kprobe and associate the process PID that calls the function with the created TCP connection.

[0051] 2. Store in eBPF map, key is source address + destination address, value is process PID,

[0052] 3. In the subsequent network protocol stack modules such as tc, the corresponding PID can be retrieved by accessing this eBPF map;

[0053] 4. Use eBPF tc to capture outgoing TCP packets

[0054] 5. Parse the SYN message in the outgoing TCP data packet, match the TCP fingerprint template corresponding to the pre-configured pid, and modify the tcp options to simulate the fingerprint into the pre-made template

[0055] 6. Recalculate the checksum and then send the modified TCP data packet.

[0056] Processing flow:

[0057] 1. Get the process ID:

[0058]

[0059] 2. Check process fingerprint:

[0060]

[0061] -Find out whether the current process has corresponding fingerprint data;

[0062] - If not, return directly;

[0063] 3. Read socket information:

[0064]

[0065] -Read the socket structure from the kernel;

[0066] 4. Check the address family:

[0067]

[0068] - Only handle IPv4 connections (AF_INET);

[0069] 5. Extract source address and port:

[0070]

[0071]

[0072] 6. Storage fingerprint mapping:

[0073]

[0074] - Associate source address+port with process fingerprint.

[0075] Modify the TCP packet to the TCP SYN packet characteristic of macOS.

[0076] Processing flow:

[0077] 1. Modify the packet length

[0078]

[0079] Use the bpf_skb_change_tail function to extend the tail of the packet to the macOS TCP packet length (MACOS_HEADER_LEN).

[0080] 2. Modify the IP header field

[0081]

[0082] Set the total length field in the IP header to 64.

[0083] Set the TTL field in the IP header to 64.

[0084] 3. Modify the TCP header field

[0085]

[0086]

[0087] Set the length field in the TCP header to 44.

[0088] Set the window size field in the TCP header to 65535.

[0089] 4. Set TCP options

[0090]

[0091] Get the current timestamp (in milliseconds).

[0092] Constructs macOS's TCP option fields, including MSS, window scale factor, timestamp, etc.

[0093] Writes the TCP options field to the packet.

[0094] 5. Update checksum

[0095]

[0096] Update TCP checksum.

[0097] Update IP checksum.

[0098] 6. Return results

[0099]

[0100] If the modification is successful, return Ok(()).

[0101] Modify the TCP packet to the TCP SYN packet characteristics of Windows.

[0102] Processing flow:

[0103] 1. Modify the packet length

[0104]

[0105] Use the bpf_skb_change_tail function to extend the tail of the packet to the Windows TCP packet length (WINDOWS_HEADER_LEN).

[0106] 2. Modify the IP header field

[0107]

[0108] Set the total length field in the IP header to 52.

[0109] Set the TTL field in the IP header to 64.

[0110] 3. Modify the TCP header field

[0111]

[0112] Set the length field of the TCP header to 32.

[0113] Set the window size field in the TCP header to 64240.

[0114] 4. Set TCP options

[0115]

[0116] Constructs a Windows TCP options field.

[0117] Writes the TCP options field to the packet.

[0118] 5. Update checksum

[0119]

[0120] Update TCP checksum.

[0121] Update IP checksum.

[0122] 6. Return results

[0123]

[0124] If the modification is successful, return Ok(()).

[0125] Example 1

[0126] like Figure 1 As shown, this embodiment provides a TCP fingerprint simulation method according to a process, including the following steps:

[0127] Step 1: Use eBPF kprobe to track the call of tcp_connect kernel function;

[0128] Step 2: If there is a call, use eBPF TC to capture the TCP data packet to be sent;

[0129] Step 3: Associate the PID of the process that calls the function with the created TCP connection and store it in the eBPF map.

[0130] Step 4: Parse the TCP data packet to obtain the SYN message, obtain the corresponding original fingerprint, and replace the original fingerprint with the simulated fingerprint of the prefabricated template;

[0131] Step 5: Recalculate the checksum of the TCP data packet, assemble it into a new TCP data packet, and send the new TCP data packet.

[0132] In this embodiment, preferably, step 3 specifically includes: associating the PID of the process that calls the function with the created TCP connection and storing them in the eBPF map; the key of the map is the source address and the destination address, and the value of the map is the process PID.

[0133] In this embodiment, preferably, the step 4 specifically includes: parsing the TCP data packet to obtain a SYN message, acquiring a corresponding original fingerprint, selecting a prefabricated template, and replacing the original fingerprint with a simulated fingerprint of the prefabricated template.

[0134] In this embodiment, preferably, the prefabricated template includes: simulating Windows fingerprint and simulating macOS fingerprint, wherein the simulating Windows fingerprint is specifically: modifying the original fingerprint,

[0135] The IP length is set to 52 bytes;

[0136] TTL is set to 64;

[0137] TCP Data Offset: Set to 32 bytes, indicating a 12-byte TCP option.

[0138] Window size: set to 64240,

[0139] TCP options include: MSS, window scaling, SACK, and NOP padding;

[0140] The simulated macOS fingerprint is specifically: modifying the original fingerprint,

[0141] The IP length is set to 64 bytes;

[0142] TTL: set to 64;

[0143] TCP Data Offset: Set to 44 bytes, indicating 24 bytes of TCP options;

[0144] Window size: set to 65535;

[0145] TCP options include: MSS, window scaling, SACK, timestamp, and NOP padding.

[0146] Based on the same inventive concept, this application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0147] Example 2

[0148] like Figure 2 As shown, in this embodiment, a TCP fingerprint simulation device according to a process is provided, including:

[0149] The tracing module uses eBPF's kprobe to trace the call of the tcp_connect kernel function;

[0150] The capture module, if called, uses eBPF's TC to capture the TCP data packets to be sent;

[0151] The association module associates the PID of the process that calls the function with the created TCP connection and stores it in the eBPF map;

[0152] The simulation module parses the TCP data packet, obtains the SYN message, obtains the corresponding original fingerprint, and replaces the original fingerprint with the simulated fingerprint of the prefabricated template;

[0153] The resend module recalculates the checksum of the TCP data packet, then assembles it into a new TCP data packet and sends the new TCP data packet.

[0154] In this embodiment, preferably, the association module specifically associates the PID of the process that calls the function with the created TCP connection and stores them in an eBPF map; the key of the map is the source address and the destination address, and the value of the map is the process PID.

[0155] In this embodiment, preferably, the simulation module specifically: parses the TCP data packet to obtain a SYN message, acquires a corresponding original fingerprint, selects a prefabricated template, and replaces the original fingerprint with a simulated fingerprint of the prefabricated template.

[0156] In this embodiment, preferably, the prefabricated template includes: simulating Windows fingerprint and simulating macOS fingerprint, wherein the simulating Windows fingerprint is specifically: modifying the original fingerprint,

[0157] The IP length is set to 52 bytes;

[0158] TTL is set to 64;

[0159] TCP Data Offset: Set to 32 bytes, indicating a 12-byte TCP option.

[0160] Window size: set to 64240,

[0161] TCP options include: MSS, window scaling, SACK, and NOP padding;

[0162] The simulated macOS fingerprint is specifically: modifying the original fingerprint,

[0163] The IP length is set to 64 bytes;

[0164] TTL: set to 64;

[0165] TCP Data Offset: Set to 44 bytes, indicating 24 bytes of TCP options;

[0166] Window size: set to 65535;

[0167] TCP options include: MSS, window scaling, SACK, timestamp, and NOP padding.

[0168] Since the device described in the second embodiment of the present invention is used to implement the method of the first embodiment of the present invention, those skilled in the art will be able to understand the specific structure and variations of the device based on the method described in the first embodiment of the present invention, and therefore will not be described in detail here. All devices used in the method of the first embodiment of the present invention fall within the scope of protection of the present invention.

[0169] Based on the same inventive concept, this application provides an electronic device embodiment corresponding to the first embodiment, see the third embodiment for details.

[0170] Example 3

[0171] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, any implementation method in the first embodiment can be implemented.

[0172] Since the electronic device described in this embodiment is the device used to implement the method in Example 1 of this application, based on the method described in Example 1 of this application, those skilled in the art will be able to understand the specific implementation of the electronic device of this embodiment and its various variations. Therefore, how the electronic device implements the method in the embodiment of this application will not be described in detail here. As long as the device used by those skilled in the art to implement the method in the embodiment of this application falls within the scope of protection to be provided by this application.

[0173] Based on the same inventive concept, this application provides a storage medium corresponding to Example 1, see Example 4 for details.

[0174] Example 4

[0175] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any implementation method in the first embodiment can be implemented.

[0176] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0177] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0178] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0179] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0180] Although the specific embodiments of the present invention are described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A TCP fingerprint simulation method according to a process, characterized in that: The steps include: Step 1: Use eBPF kprobe to track the call of tcp_connect kernel function; Step 2: If there is a call, use eBPF TC to capture the TCP data packet to be sent; Step 3: Associate the PID of the process that calls the function with the created TCP connection and store it in the eBPF map. Step 4: Parse the TCP data packet to obtain the SYN message, obtain the corresponding original fingerprint, and replace the original fingerprint with the simulated fingerprint of the prefabricated template; Step 5: Recalculate the checksum of the TCP data packet, assemble it into a new TCP data packet, and send the new TCP data packet.

2. The process-based TCP fingerprint simulation method according to claim 1, wherein: Step 3 specifically involves associating the PID of the process that calls the function with the created TCP connection and storing them in an eBPF map; the key of the map is the source address and the destination address, and the value of the map is the process PID.

3. The process-based TCP fingerprint simulation method according to claim 1, wherein: The step 4 specifically includes: parsing the TCP data packet to obtain a SYN message, acquiring a corresponding original fingerprint, selecting a prefabricated template, and replacing the original fingerprint with a simulated fingerprint of the prefabricated template.

4. The process-based TCP fingerprint simulation method according to claim 1, wherein: The prefabricated templates include: simulated Windows fingerprints and simulated macOS fingerprints. The simulated Windows fingerprint is specifically: modify the original fingerprint, The IP length is set to 52 bytes; TTL is set to 64; TCP Data Offset: Set to 32 bytes, indicating a 12-byte TCP option. Window size: set to 64240, TCP options include: MSS, window scaling, SACK, and NOP padding; The simulated macOS fingerprint is specifically: modifying the original fingerprint, The IP length is set to 64 bytes; TTL: set to 64; TCP Data Offset: Set to 44 bytes, indicating 24 bytes of TCP options; Window size: set to 65535; TCP options include: MSS, window scaling, SACK, timestamp, and NOP padding.

5. A process-based TCP fingerprint simulation device, characterized in that: include: The tracing module uses eBPF's kprobe to trace the call of the tcp_connect kernel function; The capture module, if called, uses eBPF's TC to capture the TCP data packets to be sent; The association module associates the PID of the process that calls the function with the created TCP connection and stores it in the eBPF map; The simulation module parses the TCP data packet, obtains the SYN message, obtains the corresponding original fingerprint, and replaces the original fingerprint with the simulated fingerprint of the prefabricated template; The resend module recalculates the checksum of the TCP data packet, then assembles it into a new TCP data packet and sends the new TCP data packet.

6. The process-based TCP fingerprint simulation device according to claim 5, characterized in that: The association module specifically associates the PID of the process that calls the function with the established TCP connection and stores them in the eBPF map; the key of the map is the source address and the destination address, and the value of the map is the process PID.

7. The process-based TCP fingerprint simulation device according to claim 5, characterized in that: The simulation module specifically parses the TCP data packet to obtain a SYN message, acquires a corresponding original fingerprint, selects a prefabricated template, and replaces the original fingerprint with a simulated fingerprint of the prefabricated template.

8. The process-based TCP fingerprint simulation device according to claim 5, characterized in that: The prefabricated templates include: simulated Windows fingerprints and simulated macOS fingerprints. The simulated Windows fingerprint is specifically: modify the original fingerprint, The IP length is set to 52 bytes; TTL is set to 64; TCP Data Offset: Set to 32 bytes, indicating a 12-byte TCP option. Window size: set to 64240, TCP options include: MSS, window scaling, SACK, and NOP padding; The simulated macOS fingerprint is specifically: modifying the original fingerprint, The IP length is set to 64 bytes; TTL: set to 64; TCP Data Offset: Set to 44 bytes, indicating 24 bytes of TCP options; Window size: set to 65535; TCP options include: MSS, window scaling, SACK, timestamp, and NOP padding.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images