Illegal external connection route detection method and system

Abstract

The invention provides an illegal external connection route detection method. The method comprises the following steps: S1, obtaining a DNS request pointing to an external network service domain name and a terminal sending the request; s2, if the intranet DNS service cannot analyze the extranet domain name, sending a DNS response message to the terminal in the first time; s3, within second time, acquiring all DNS response messages sent to the terminal, and recording response IPs in the DNS response messages; acquiring a connection request initiated by the terminal, judging whether the connection request points to the response IP, and if not, recording abnormity once; s4, repeatedly executing the steps S1 to S3 within the third time; and if the abnormal frequency proportion exceeds a preset threshold value, judging that illegal routing exists in the terminal. According to the invention, based on the monitoring of the flow of the internal network side, the illegal external connection behavior of the terminal IP at the external network side can be continuously monitored in a zero-intruding mode, and the defects of the existing active and passive monitoring mode are avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a method and system for detecting illegal external connection route. BACKGROUND

[0002] In order to protect information security and avoid leakage of confidential information, there is often a demand for prohibiting office computers from accessing the Internet in government and enterprise intranets. Accordingly, there are various methods in the industry for checking illegal external connection of terminals in the network, which can be roughly divided into two categories:

[0003] (1) Checking based on terminal agent. This method requires installing an agent on the terminal to record changes in device network and external connection behavior, and to alarm for illegal behavior.

[0004] (2) Checking based on network traffic. This includes active monitoring and passive detection. Active detection sends an icmp or tcpsyn packet to the terminal through the intranet interface, and fakes the source address as an Internet IP. If an answer is received, it means that there is an illegal route. However, modern operating systems will turn on reverse route filtering (rp_filter, reverse path filter) by default, and the terminal will ignore these illegal requests, causing this monitoring method to be generally ineffective.

[0005] Passive monitoring selects a URL that is universally accessed in the intranet service as a monitoring point. When the terminal browser accesses it, the monitoring device sends a redirect response or directly injects a monitoring-capable html / javascrIPt to the terminal, so that the monitoring code runs in the terminal browser and attempts to connect externally. If it succeeds, it means that there is an illegal route. This method causes the user's browser to flash, which is perceptible. Moreover, it can only be monitored when the user accesses the monitoring point, causing low coverage in the time dimension.

[0006] The above methods have a range of effective use, but also have some limitations and inconveniences. The checking based on terminal agent has high accuracy, but requires installation of software on the terminal. The web access hijacking method cannot be used frequently due to user perception, and can only hijack and inject for a limited number of URLs, resulting in low coverage and detection frequency. SUMMARY

[0007] In order to overcome the above-mentioned defects of the prior art, the present application provides a method for detecting illegal external connection route, comprising:

[0008] S1, obtaining a DNS request pointing to an external service domain name and a terminal sending the request;

[0009] S2, if the intranet DNS service can not resolve the external domain name, then in the first time to construct and reply to the terminal and deliver the DNS response message, the DNS response message in the response IP is set to the predetermined hijacking response IP;

[0010] S3. Within the second time, obtain all DNS response messages sent to the terminal and record the response IP in the DNS response message to form a response IP set; obtain the connection request initiated by the terminal and determine whether the connection request points to the response IP in the response IP set. If not, record an exception once; if so, record a normal once;

[0011] S4. Repeat S1-S3 within the third time period; if the ratio of the number of abnormalities to the total number of records exceeds a predetermined threshold, it is determined that the terminal has an illegal route.

[0012] Furthermore, in S1, the intranet traffic is mirrored and the data packets are analyzed.

[0013] Furthermore, the first time is less than the time it takes for the intranet DNS service to reply to the terminal and deliver an empty response.

[0014] Furthermore, the first time is 10ms.

[0015] Furthermore, the second time is greater than the time it takes for the intranet DNS service to reply to the terminal and deliver a response, and is preferably 50 ms.

[0016] Furthermore, it also includes, in S2, if the intranet DNS service can resolve the external network domain name, obtaining the normal DNS response information sent by the intranet DNS service, and in S3, storing the response IP in the normal DNS response information into the response IP set.

[0017] According to another aspect of the present invention, a detection system for illegal external routing is proposed, comprising: a mirror monitoring module, a DNS response module, and a statistics module, wherein:

[0018] The mirror monitoring module is used to mirror the intranet traffic, obtain the data packet containing the domain name of the illegal external website, and send the illegal external website domain name and terminal IP (i.e., the terminal that initiated the illegal external connection) in the data packet to the DNS response module; it determines whether the terminal IP sends a connection request to the response IP in the second time, and sends the result to the statistics module;

[0019] The DNS response module is used to receive the illegal external website domain name and terminal IP sent by the mirror monitoring module; if the intranet DNS service cannot resolve the external domain name, it constructs and delivers a DNS response message as soon as possible, where the response IP is the preset hijacking response IP, forming a response IP set;

[0020] The statistics module is used to receive the result of whether the connection request directed to the response IP in the response IP set is sent by the mirror monitoring module; if there is no connection request within a second time (for example, within 50ms), an abnormality is recorded for the terminal IP once, otherwise a normality is recorded once; if the proportion of abnormal times of the terminal IP exceeds a predetermined threshold within a third time, it is determined that the terminal has an illegal route.

[0021] Furthermore, the first time is less than the time it takes for the intranet DNS service to reply to the terminal IP and deliver an empty response.

[0022] Furthermore, in the DNS response module, if the intranet DNS service can resolve the external domain name, the normal DNS response information sent by the intranet DNS service is obtained, and the response IP in the normal DNS response information is stored in the response IP set.

[0023] The benefits of the present invention include:

[0024] (1) Through mirror traffic monitoring, the terminal is monitored in a zero-intrusion manner.

[0025] (2) No need to redirect requests or inject web page content, zero interference with intranet business access.

[0026] (3) Continuous monitoring with full coverage in the time dimension. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic diagram of a flow chart of an illegal routing detection method according to an embodiment of the present invention;

[0028] Figure 2 This is a diagram of the network interaction process without external channels;

[0029] Figure 3 A schematic diagram of the network interaction process with an external channel;

[0030] Figure 4 The figure is a schematic diagram of the structure of an illegal routing detection system according to an embodiment of the present invention.

[0031] As shown in the figure, in order to clearly implement the structure or method of the embodiment of the present invention, specific marking symbols are marked in the figure, but this is only for illustrative purposes and is not intended to limit the present invention to this specific device and environment. According to specific needs, ordinary technicians in this field can adjust and modify these elements, labels, and environments, and the adjustments and modifications made are still included in the scope of the appended claims. DETAILED DESCRIPTION

[0032] The following describes in detail the method and system for detecting illegal external routes provided by the present invention in conjunction with the accompanying drawings and specific embodiments.

[0033] In the following description, various aspects of the present invention will be described. However, it will be apparent to those skilled in the art that the present invention may be practiced utilizing only some or all of the features of the present invention. Specific numbers, configurations, and sequences are described for clarity of explanation, but it is apparent that the present invention may be practiced without these specific details. In other cases, well-known features will not be described in detail to avoid obscuring the present invention.

[0034] The present invention proposes a method for detecting illegal external routing. The principle is as follows: when a terminal needs to connect to an unknown domain name, the operating system, such as Windows, will send a DNS request to all active network interfaces because it does not know the IP address of the domain name. Most DNS requests are automatically triggered by socket connection requests. Therefore, after receiving a successful DNS resolution, the terminal will immediately initiate a TCP or UDP connection request to the IP address corresponding to the domain name. Within an intranet, by collecting certain information, the composition of intranet domain names can be easily understood. By observing the DNS domain name resolution requests issued by the terminal IP address, after ignoring the intranet domain name, request packets for external domain names (such as www.wps.com) are tracked and monitored. Since Windows sends DNS requests to both the intranet and external network cards simultaneously, it only selects the external network card (the external routing interface) for the actual connection. Therefore, only the DNS request and response are monitored on the intranet network card, but the response IP address obtained from the intranet connection is not detected. If the intranet DNS does not support external domain name queries, it will reply with an empty response to the external domain name query. In this case, it is necessary to ensure that a DNS response pointing to a preset address (hijacked response IP) is returned within a short period of time so that the terminal can obtain the response IP from the intranet and obtain the data packets initiated by the terminal IP. If the terminal IP does not initiate a new connection to a response IP in the destination address set obtained through the DNS response after obtaining a legitimate response DNS request, it indicates one of the following situations:

[0035] (1) The terminal obtains other IP addresses of the external domain name from other interfaces;

[0036] (2) The terminal has other communication gateways to connect to the response IP.

[0037] Based on the regulatory requirements of government and enterprise intranets, the above two situations are both illegal external connections.

[0038] For connections directed to the hijacked response IP, you can proxy (web) or deny incoming connections. Since requests directed to external www services are illegal requests, hijacking these DNS requests will not affect any business.

[0039] The present invention proposes a method for detecting illegal external routing, such as Figure 1 Shown, including:

[0040] S1. Obtain a DNS request pointing to an external service domain name and the terminal that sends the request;

[0041] S2, if the intranet DNS service can not resolve the external domain name, then in the first time constructed and delivered to the terminal DNS response message, the DNS response message in the response IP is the predetermined hijacking response IP;

[0042] S3. Within the second time, obtain all DNS response messages sent to the terminal and record the response IP in the DNS response message to form a response IP set; obtain the connection request initiated by the terminal, determine whether the connection request points to the response IP in the response IP set, and if not, record an exception once; if so, record a normal once;

[0043] S4. Repeat S1-S3 within the third time period; if the ratio of the number of abnormalities to the total number of records exceeds a predetermined threshold, it is determined that the terminal has an illegal route.

[0044] In S1, you can mirror intranet traffic and then capture and analyze terminal data packets. Traffic mirroring refers to copying network traffic from a network switch, optical splitter, or host network interface card and sending network packets to other designated host network interfaces to facilitate content inspection, monitoring analysis, and troubleshooting. By copying and filtering out qualified traffic, traffic mirroring can capture and record network traffic without affecting network performance. This helps administrators diagnose network failures and detect network attacks. It is commonly used in scenarios such as security monitoring, network operations and maintenance, and compliance auditing.

[0045] After mirroring traffic, you can filter it. This involves checking for DNS requests within the packet that point to illegal external URLs (i.e., URLs not allowed to be accessed externally within the intranet). For example, if terminal A (assuming the IP address is 192.168.10.201) initiates a DNS request for www.baidu.com, the captured packet is analyzed to obtain the source IP address (i.e., the terminal address) and the requested external domain name (i.e., www.baidu.com in this example). The DNS query initiated by the terminal is then checked for domain names. If they are external, the query (i.e., external DNS request) is recorded.

[0046] In S2, if the intranet does not support queries for external domain names, the intranet DNS service will send an empty response to the terminal. In this case, a constructed DNS response message must be sent before the intranet DNS service responds and delivers it. Therefore, the initial time must be less than the time it takes for the intranet DNS service to respond and deliver an empty response to the terminal. The response message includes a preset hijacked response IP (e.g., 1.1.1.1), which corresponds to the requested external service domain name. Upon receiving this message, the terminal will identify the hijacked response IP as the IP address corresponding to the external website and will send a TCP or UDP connection request with the IP address corresponding to the external website as the destination address.

[0047] In one embodiment, the first time is 10 ms, thereby ensuring that the delivery time of the DNS empty response from the intranet DNS server is covered, and ensuring that the terminal obtains a legal DNS response from the intranet.

[0048] The DNS response message is a response packet to the external DNS request sent by the terminal. The fields of the DNS response message are existing. When constructed, the content of the response field is the response IP, which is set to the predetermined hijacked response IP, that is, the IP corresponding to the external domain name.

[0049] If the terminal has multiple active interfaces, it will send DNS requests to each active interface and may obtain multiple alternative response IP addresses from multiple DNS servers. The terminal will send a connection request to one of the response IPs (generally present in the earliest DNS response), and the other response IPs will be discarded, that is, no connection requests will be sent to these alternative response IP addresses. The present invention also determines whether the terminal has an external interface (i.e., routing) based on this.

[0050] Mirrored traffic is continuously analyzed in S3, capturing DNS response messages sent to the endpoint. The response IP addresses in these DNS responses (including potentially hijacked response IP addresses) are tracked and recorded to form a response IP set. A terminal may request the same domain name from multiple DNS servers, and these servers will all respond with DNS responses, potentially including multiple candidate response IP addresses in the same DNS response. The terminal will select only one of these response IP addresses to connect to.

[0051] Typically, a terminal will quickly send a connection request after receiving a DNS response. Therefore, a second timeout is set. For each DNS response, if no connection request to the response IP address of the DNS response is received within the second timeout, an exception is recorded; if a connection request is received, a normal response is recorded. The second timeout is relatively short, but should be greater than the time it takes for the intranet DNS service to respond and deliver an empty response. For example, it can be set to 50ms.

[0052] In S3, such as Figure 2As shown, if the captured connection request is a connection request pointing to a certain response IP in the response IP set, it means that the terminal has no illegal routing; if no connection request pointing to a certain response IP is detected, it means that the terminal has other paths or the connection is stopped due to some abnormality, and the abnormality is recorded once. Figure 3 As shown, the terminal obtains the IP of the external website from the wireless channel and completes the connection access, so it will no longer initiate a connection to the hijacked response IP through the intranet.

[0053] In S4, S1-S3 are repeatedly executed within a third time period, and the number of anomalies and the total number of anomalies within this time period are counted. The third time period can be set to be longer, such as 5 minutes. In this way, after the third time period expires, if the number of anomalies exceeds a predetermined threshold, such as 60%, it can be determined that the terminal has an illegal external gateway and path, that is, an illegal route.

[0054] In one embodiment, it also includes, in S2, if the intranet DNS service can resolve the external network domain name, obtaining the normal DNS response information replied by the intranet DNS server through the mirror traffic, and storing the response IP in the response IP set in S3.

[0055] The present invention also proposes a detection system for illegal external routing, such as Figure 4 As shown, it includes: mirror monitoring module, DNS response module, and statistics module, among which,

[0056] The mirror monitoring module is used to mirror the intranet traffic, obtain the data packet containing the domain name of the illegal external website, and send the illegal external website domain name and terminal IP (i.e., the terminal that initiated the illegal external connection) in the data packet to the DNS response module. It can also determine whether the terminal IP sends a connection request to the external network domain name response IP in a second time, and send the result to the statistics module;

[0057] The DNS response module is used to receive the illegal external website domain name and terminal IP sent by the mirror monitoring module; if the internal network DNS service cannot resolve the external network domain name, it will construct and deliver a DNS response message as soon as possible, in which the response IP is the preset hijacking response IP and send it to the terminal IP;

[0058] The statistics module is configured to receive the result from the mirror monitoring module regarding whether a connection request directed to a response IP in the response IP set has been sent. If no connection request is sent within a second time period (e.g., within 50 milliseconds), an abnormality is recorded for the terminal IP; otherwise, a normality is recorded. If the proportion of abnormalities for the terminal IP exceeds a predetermined threshold within a third time period, the terminal is determined to have engaged in illegal routing.

[0059] In one embodiment, the first time is less than the time when the intranet DNS service replies with an empty response, i.e. the sent DNS response message arrives before the empty response of the intranet DNS service.

[0060] In one embodiment, in the DNS response module, if the intranet DNS service can resolve the extranet domain name, the normal DNS response information sent by the intranet DNS service is acquired, and the reply IP in the normal DNS response information is stored in the reply IP set.

[0061] The above embodiments are only used for describing the technical solutions of the present application, but not for limiting the present application; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced equivalently; and the modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting illegal external routing, characterized in that: include: S1. Obtain a DNS request pointing to an external service domain name and the terminal that sends the request; S2, if the intranet DNS service can not resolve the external domain name, then in the first time reply to the terminal and deliver the DNS response message, the DNS response message in the response IP is set to the predetermined hijacking response IP; S3. Within the second time, obtain all DNS response messages sent to the terminal and record the response IP in the DNS response message to form a response IP set; obtain the connection request initiated by the terminal and determine whether the connection request points to the response IP in the response IP set. If not, record an exception once; if so, record a normal once; S4. Repeat S1-S3 within the third time period; if the ratio of the number of abnormalities to the total number of records exceeds a predetermined threshold, it is determined that the terminal has an illegal route.

2. The detection method according to claim 1, wherein In S1, mirror the intranet traffic and analyze the data packets.

3. The detection method according to claim 1, wherein The first time is less than the time it takes for the intranet DNS service to deliver an empty response to the terminal.

4. The detection method according to claim 3, characterized in that The first time is 10ms.

5. The detection method according to claim 1, wherein The second time is greater than the time it takes for the intranet DNS service to deliver a response to the terminal.

6. The detection method according to claim 1, characterized in that The second time is 50ms.

7. The detection method according to claim 1, characterized in that It also includes, in S2, if the intranet DNS service can resolve the external network domain name, obtaining the normal DNS response information sent by the intranet DNS service, and in S3, storing the response IP in the normal DNS response information into the response IP set.

8. A detection system for illegal external routing, characterized in that: include: Mirror monitoring module, DNS response module, statistics module, among which, The mirror monitoring module is used to mirror the intranet traffic, obtain the data packet containing the domain name of the illegal external website, and send the illegal external website domain name and terminal IP (i.e., the terminal that initiated the illegal external connection) in the data packet to the DNS response module; it determines whether the terminal IP sends a connection request to the response IP in the second time, and sends the result to the statistics module; The DNS response module is used to receive the illegal external website domain name and terminal IP sent by the mirror monitoring module; if the intranet DNS service cannot resolve the external domain name, it constructs and delivers a DNS response message as soon as possible, where the response IP is the preset hijacking response IP, forming a response IP set; The statistics module is used to receive the result of whether the connection request directed to the response IP in the response IP set is sent by the mirror monitoring module; if there is no connection request within a second time (for example, within 50ms), an abnormality is recorded for the terminal IP once, otherwise a normality is recorded once; if the proportion of abnormal times of the terminal IP exceeds a predetermined threshold within a third time, it is determined that the terminal has an illegal route.

9. The detection system according to claim 8, characterized in that: The first time is less than the time it takes for the intranet DNS service to deliver an empty response to the terminal IP.

10. The detection system according to claim 8, characterized in that: In the DNS response module, if the intranet DNS service can resolve the external domain name, the normal DNS response information sent by the intranet DNS service is obtained, and the response IP in the normal DNS response information is stored in the response IP set.

Images