APT network threat grading detection method and system based on programmable data plane

Abstract

The invention relates to an APT network threat grading detection method and system based on a programmable data plane, and the method comprises the steps: obtaining a malicious domain name and a malicious IP address, and carrying out the preprocessing; segmenting the preprocessed malicious domain name into a plurality of domain tags, and calculating a hash value for each domain tag; the programmable data plane creates a plurality of malicious domain name information tables and malicious IP information tables, and sends the combined hash value and the preprocessed malicious IP address to the malicious domain name information tables and the malicious IP information tables of the programmable data plane; the programmable data plane receives the network flow data packet and identifies the network flow data packet; if the data packet is a domain name resolution data packet, performing domain name resolution, extracting domain name information, calculating a combined hash value for the extracted domain name information, matching the combined hash value with a malicious domain name information table, and executing a preset action according to a matching result; and if the IP packet is a common IP packet, the IP packet is matched with the malicious IP information table, and APT network threat grading detection is completed.

Description

Technical Field

[0001] This invention relates to a method and system for classifying and detecting APT network threats based on a programmable data plane, belonging to the field of computer network security technology. Background Technology

[0002] With the rapid development of network applications, APT (Advanced Persistent Threat) attacks have become one of the major challenges to network security. APT attacks are typically characterized by long latency periods, strong targeting, and complex methods. Attackers often gradually infiltrate target networks through methods such as Domain Name System (DNS) and communication with specific IP addresses, and use encrypted traffic or common services to conceal their activities. Therefore, how to quickly detect and classify potential malicious domain names and IP addresses at the network transmission layer is a critical issue that current APT defense systems urgently need to address.

[0003] In existing technologies, APT threat detection mainly relies on deep packet inspection (DPI) or log analysis in the control plane. While these methods can achieve accurate detection, they have the following shortcomings: (1) Limited processing performance: In high-bandwidth scenarios, the control plane has insufficient processing capabilities, making it difficult to perform IOC (Indicator of Compromise) detection on large-scale network traffic in real time.

[0004] (2) High detection latency: Data packets need to be forwarded, copied and reported, which increases the detection latency and makes it difficult to respond to rapidly spreading APT attacks in a timely manner.

[0005] (3) Poor dynamic adaptability: Existing detection schemes often rely on fixed rules and are difficult to adjust quickly according to external intelligence or newly emerging IOC information, resulting in insufficient threat detection coverage.

[0006] With the development of programmable data plane technology, especially devices represented by P4 language and programmable switching chips (such as Tofino), it is possible to flexibly define packet parsing and matching logic on the hardware forwarding path, providing a new implementation approach for high-speed, low-latency APT detection. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides an APT network threat classification detection method and system based on a programmable data plane. This method overcomes the deficiencies of existing APT detection technologies in terms of performance, real-time performance, and dynamic adaptability. It enables high-speed matching and classification detection of malicious domain names and malicious IPs, and supports dynamic rule updates and result reporting, thereby improving the efficiency and accuracy of APT defense.

[0008] This invention is divided into a control plane and a data plane. The control plane is responsible for generating malicious IOC entries based on IOC malicious domain name intelligence and IOC malicious IP intelligence. The data plane is responsible for identifying traffic based on the malicious IOC entries generated by the control plane, and blocking and uploading traffic according to the settings of the malicious IOC entries, thereby realizing the blocking and control of malicious traffic.

[0009] Terminology Explanation: 1. IOC (Indicator of Compromise): This is evidence that an organization's network or system may have been attacked (e.g., malware infection, data breach), such as access to a malicious organization's domain name or access to a malicious organization's IP address.

[0010] 2. CRC32 Algorithm (Cyclic Redundancy Check 32): An error detection code algorithm used to generate a 32-bit checksum. It treats the input data as a binary polynomial and performs a division operation on it using a predefined generator polynomial. The remainder is the 32-bit hash value. The CRC32 algorithm not only possesses cryptographic security but also exhibits extremely high computational efficiency and performance when implemented in network hardware. It is well-suited for hash calculations in the data plane and has a low collision rate, making it suitable for matching operations.

[0011] 3. Programmable Data Plane: The data plane is responsible for forwarding and processing data packets. Programmable data plane is a network technology that allows users to customize the data packet processing logic through programming. Its core goal is to break the limitations of traditional hardware on forwarding functions and realize flexible configuration and optimization of network devices.

[0012] The technical solution of the present invention is as follows: The first aspect of this invention provides a method for graded detection of APT network threats based on a programmable data plane, comprising: Step 1: The control plane obtains malicious domain names and malicious IP addresses and performs preprocessing; Step 2: Segment the preprocessed malicious domain name into multiple domain tags, calculate the hash value for each domain tag, and perform hash calculation on the hash value of the domain tags again according to the number of domain tags to obtain the combined hash value; Step 3: The programmable data plane creates multiple malicious domain name information tables and malicious IP information tables, and sends the combined hash value and the preprocessed malicious IP address to the malicious domain name information tables and malicious IP information tables in the programmable data plane; Step 4: The programmable data plane receives and identifies network traffic data packets, determining whether the data packets are domain name resolution data packets or ordinary IP packets; If it is a domain name resolution data packet, then perform domain name resolution, extract domain name information, calculate the combined hash value of the extracted domain name information, match it with the malicious domain name information table, and execute the preset action according to the matching result; If it is a regular IP packet, it is matched against the malicious IP information table. If the match is the same, a digest is generated based on the content of the regular IP packet and sent to the control plane. Otherwise, the regular IP packet is further detected and analyzed to complete the APT network threat classification detection.

[0013] According to a preferred embodiment of the present invention, the control plane acquires malicious domain names and malicious IP addresses, and performs preprocessing; including: The control plane periodically (set to a range of every 5 minutes to every hour, depending on the APT threat intelligence source update rate and security policy requirements) retrieves malicious domain names and malicious IP addresses from the APT threat intelligence source; APT threat intelligence sources continuously provide real-time data streams on network threat information, including IOC information related to APT activities, namely malicious domain names and malicious IP addresses. These APT threat intelligence sources can be open-source community-driven platforms (such as AlienVault OTX, Abuse.ch URLhaus) or commercial subscription services (such as CrowdStrike FalconIntelligence, Mandiant Threat Intelligence). Preprocess the acquired malicious domain names and malicious IP addresses, including data deduplication and risk classification; Data deduplication includes: after receiving malicious domain names and malicious IP addresses, deleting duplicate entries and retaining only unique malicious domain names and malicious IP addresses for subsequent processing; this eliminates duplicate IOC entries from different intelligence sources; for example, if three intelligence sources all mark evil.com as malicious, the system will only process it as a unique IOC, which helps optimize the limited storage resources of the programmable data plane. Risk grading includes: after data deduplication, assigning a risk level (e.g., high, medium, low) to each unique malicious domain name and malicious IP address based on the data source. High risk: domain names known to be associated with C2 servers of state-sponsored APT organizations, or information from multiple APT intelligence sources; low risk: domain names hosting adware, or information from a single APT intelligence source; or specifying the risk level of a malicious domain name or malicious IP address based on demand strategies.

[0014] According to a preferred embodiment of the present invention, step 2 specifically comprises: Malicious domains with specified risk levels are segmented according to requirements (e.g., administrators only need to distribute high-risk malicious domains to the data plane). This is done by using the domain name separator (e.g., "." as the separator) as the basis to segment malicious domains with specified risk levels into multiple domain tags, forming a domain tag sequence (e.g., for the domain name "abcexample.com", "." is used as the separator to segment it, resolving it into the domain tag sequence [a][b][c][example][com]). Calculate the hash value independently for each domain tag in the domain tag sequence to generate a domain hash sequence of length MAX_LABLE (e.g., length 8). If the number of domain tags is insufficient, pad with zeros. If MAX_LABEL=8, each field label is processed using the CRC32 algorithm to obtain a corresponding 4-byte hash value, such as: h1 = CRC32(a); h2 = CRC32(b); h3 = CRC32(c); h4 = CRC32(example); h5 = CRC32(com); h6 = CRC32(0); h7 = CRC32(0); h8 = CRC32(0); This forms the domain hash sequence [h1, h2, h3, h4, h5, h6, h7, h8]; Based on the number of domain levels N, i.e., the number of domain tags (e.g., abcexample.com has 5 levels), concatenate one to N adjacent hash values ​​in the domain hash sequence and calculate the hash value to obtain combined hash values ​​L1_hash, L2_hash, ..., LN_hash at different levels; where L1_hash represents the combined hash value calculated from a single hash value in the domain hash sequence, and LN_hash represents the combined hash value calculated by concatenating N adjacent hash values ​​in the domain hash sequence. Calculating the combined hash value based on domain level N=5: L1_hash=CRC32(h5) (matches top-level fields); L2_hash=CRC32(h4,h5) (matches "example.com"); L3_hash=CRC32(h3,h4,h5) (matches "c.example.com"); L4_hash=CRC32(h2,h3,h4,h5) (matches "bcexample.com"); L5_hash=CRC32(h1,h2,h3,h4,h5) (matches "abcexample.com"); A further preferred algorithm for calculating the hash value is the CRC32 algorithm.

[0015] According to a preferred embodiment of the present invention, step 3 specifically comprises: The programmable data plane creates multiple (8) malicious domain name information tables and 1 malicious IP information table; Based on the IOC requirements, specify the matching level n (e.g., for exact matching of all domains, matching level n=N; for fuzzy matching of two domain tags, matching level n=2), and send the combined hash value Ln_hash of the corresponding level number n, n∈[1,N], to the malicious domain information table in the programmable data plane. For example, if this IOC needs to precisely match the malicious DNS packet of the domain "abcexample.com", then L5_hash is sent to the malicious domain information table at level L5. If this IOC needs to fuzzily match the malicious DNS packet of the domain "*.bcexample.com", then L4_hash is sent to the malicious domain information table at level L4. If this IOC needs to fuzzily match the malicious DNS packet of the domain "*.c.example.com", then L3_hash is sent to the malicious domain information table at level L3, and so on. At the same time, based on the requirements, malicious IP addresses with specified risk levels are sent to the malicious IP information table in the programmable data plane. The malicious domain information table includes the following entries: key_hash: Combined hash value, used to store combined hash values ​​Ln_hash, such as L1_hash, L2_hash, L3_hash, L4_hash, L5_hash; ioc_id_name: Malicious domain sequence number, used to store the sequence number value of malicious domains (a unique malicious domain sequence number automatically generated when obtaining information from APT threat intelligence sources), and used for reporting when a malicious domain information table is hit; level_name: The level number of the combined hash value, used to store the corresponding level number n, indicating which level of the malicious domain information table to send it to; tm_name: Domain name timestamp, used to store the time when the table entry for the combined hash value was issued; The malicious IP information table includes the following entries: IP: Malicious IP address, used to store malicious IP addresses, and is the basis for matching ordinary IP packets; ioc_id_IP: Malicious IP address sequence number, used to store the malicious IP address sequence number (a unique malicious IP sequence number automatically generated when obtaining information from APT threat intelligence sources), and used for reporting when the malicious IP information table is hit; level_IP: Represents a malicious IP information table for the programmable data plane, used to store the fixed value Level_IP; tm_IP: IP timestamp, used to store the time when a malicious IP address was issued as an entry.

[0016] According to a preferred embodiment of the present invention, a programmable data plane receives and identifies network traffic data packets, determining whether the data packet is a domain name resolution data packet or a regular IP packet; including: The programmable data plane receives network traffic from the switch port, identifies the protocol header of the data packets in the network traffic, that is, reads the Ethernet header and IP header in the data packets, and checks the transport layer header (TCP or UDP). If the destination port or source port is 53, the data packet is identified as a DNS data packet, that is, a domain name resolution data packet; otherwise, it is identified as a regular IP packet. According to a preferred embodiment of the present invention, if the data packet is a domain name resolution packet, domain name resolution is performed, domain name information is extracted, a combined hash value is calculated on the extracted domain name information, and it is matched with a malicious domain name information table. Based on the matching result, a preset action is executed; including: If it is a domain name resolution packet, i.e., a DNS packet, then the domain name field is obtained from the DNS packet (DNS message). The domain name field includes multiple domain label fields. For each domain tag field, read the first byte, which is the length of the domain tag field. If the value is zero, the domain name resolution ends. If it is not zero, the length counter is set to the length of the field label field, and the corresponding byte header type is selected according to the length of the field label field. The byte header types include 32 bytes, 16 bytes, 8 bytes, 4 bytes, 2 bytes, and 1 byte. Extract the content of the field label field according to the number of bytes in the byte header type. If the length of the field label field is equal to the number of bytes in the byte header type, then the byte header type with the corresponding number of bytes is selected for direct extraction, and the length counter is updated (the length counter is reduced by the corresponding number of characters after the number of characters extracted). If the length of the field label field is between the number of bytes of two header types, the header type with the smaller number of bytes is selected to extract the corresponding number of bytes in the field label field, and the length counter is updated. Then, the header type is selected until the content of the field label field is completely extracted, i.e., the length counter is 0, and the next field label field is read. If the length of the field label field is greater than the maximum number of bytes in the byte header type, then the byte header type with the maximum number of bytes is selected and the same extraction operation is performed until the length counter is 0, and then the next field label field is read. Repeat the above operation to extract the domain tag field content. If the read value is zero, the domain name resolution is over and the complete domain tag, i.e., the domain information, is obtained (e.g., "abcexample", with domain tags a, b, c, and example respectively).

[0017] For example, the domain name field is 01 61 01 62 01 63 07 65 78 61 6d 70 6c 65 00, where 01 indicates that the following byte is the domain label (i.e., "a"), 61 is the ASCII code of "a", which is the domain label field, 01 62 is the second-level domain label "b", 01 63 is the third-level domain label "c", 07 65 78 61 6d 70 6c 65 is the fourth-level domain label "example", and 00 is the terminator, indicating the end of the domain name field; If the field tag "example" is read, the first byte 07 indicates that the field tag length is 7 characters. Set the length counter to 7, select the byte header type as 4 bytes, and store "exam". The remaining 3 bytes are "ple". Update the length counter to 3, select the byte header type as 2 bytes, and store "pl". Update the length counter to 1, select the byte header type as 1 byte, and store "e". The length counter is 0, and the parsing of this field tag ends. Read the subsequent field tag bytes, which are 00, and the parsing ends.

[0018] Calculate the hash value independently for each domain tag in the domain name information to generate a domain hash sequence; based on the specified matching level n (e.g., exact match of all domain names, or wildcard fuzzy match), combine the hash values ​​from the adjacent n domain hash sequences and calculate the hash value (e.g., if the matching level is fuzzy match, only the level "*.example.com" needs to be matched, then the matching key is L2_hash). If the combination is insufficient, fill with zero values ​​to obtain the combined hash value, which is then used as the matching key. L1_hash=CRC32(h5) (matches top-level fields); L2_hash=CRC32(h4,h5) (matches "example.com"); L3_hash=CRC32(h3,h4,h5) (matches "c.example.com"); L4_hash=CRC32(h2,h3,h4,h5) (matches "bcexample.com"); L5_hash=CRC32(h1,h2,h3,h4,h5) (matches "abcexample.com"); The matching key is used to match malicious domain name information tables at all levels in the programmable data plane. If a certain combined hash value, i.e., the matching key, is the same as the value of a malicious domain name information table at a certain level, then the DNS packet is determined to have hit a malicious IOC rule; otherwise, the DNS packet is determined to have not hit a malicious IOC rule. Based on the matching results, a preset action is executed. That is, when the matching result is a match for a malicious IOC rule, the malicious domain information table is read and a packaged packet {ioc_id_name, tm_name, matched_hash, original_packet_payload} is generated. Here, ioc_id_name represents the malicious domain sequence number, tm_name represents the domain timestamp, matched_hash represents the currently matched key, and original_packet_payload represents the entire content of the matched DNS packet. The generated encapsulated message is sent to the control plane (monitoring port UDP_PORT_REPORT=4000). After receiving the encapsulated message, the control plane writes it into the APT event database (as an APT threat intelligence source) and updates the malicious domain information table. If the matching result is a no-match with a malicious IOC rule, the DNS message or copy is forwarded to an external deep analysis engine for further detection and analysis (e.g., Zeek software, an open-source network monitoring software mainly used to monitor and analyze network traffic, check the complete payload of data packets, identify known attack signatures or sensitive data leaks; analyze the behavioral characteristics of data packets over a long period of time, and detect the presence of slow and abnormal activities common in APT attacks). Based on the detection and analysis results, new preset rules, i.e., new matching levels, are generated, the malicious domain information table is dynamically updated, and the information is sent to the programmable data plane.

[0019] According to a preferred embodiment of the present invention, ordinary IP packets are matched with a malicious IP information table. If the matching result is the same, a digest information is generated based on the content of the ordinary IP packet and sent to the control plane; otherwise, the ordinary IP packet is further detected and analyzed; including: The programmable data plane receives ordinary IP packets and obtains the source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port, IP protocol field, and IP packet length from the ordinary IP packets; If the source IP address or destination IP address is the same as the malicious IP address in the malicious IP information table, it is determined that the malicious IOC address information has been hit; otherwise, it is determined that the malicious IOC address information has not been hit. If it is determined that a malicious IOC address has been hit, a digest message is generated and sent to the control plane; The summary message includes {ioc_id_IP, tm_IP, Flow_ID, source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port, IP protocol field, IP packet length}; Here, Flow_ID represents the CRC32 checksum. Metadata A and Metadata B are created. Metadata A includes {source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port}. The smaller of the source IP address and destination IP address is assigned to the ip_a field in Metadata B, and the larger one is assigned to the ip_b field. The transport layer protocol is directly assigned to the proto field in Metadata B. The smaller of the transport layer destination port and transport layer source port is assigned to the port_a field in Metadata B, and the larger one is assigned to the port_b field, resulting in Metadata B {ip_a, ip_b, proto, port_a, port_b}. The CRC32 checksum is then calculated using the CRC32 algorithm. After receiving the summary information, the control plane writes it into the APT event database (as a source of APT threat intelligence) and updates the malicious IP information table. If a malicious IOC address is not found, the programmable data plane forwards the ordinary IP packet to an external deep analysis engine for further detection and analysis; based on the detection and analysis results, the malicious IP information table is dynamically updated and sent to the programmable data plane.

[0020] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of an APT network threat classification and detection method based on a programmable data plane.

[0021] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of an APT network threat classification and detection method based on a programmable data plane.

[0022] A second aspect of the present invention provides an APT network threat classification and detection system based on a programmable data plane, comprising: The IOC information processing module is configured to: obtain malicious domain names and malicious IP addresses from the control plane and perform preprocessing; The hash calculation module is configured to: split the preprocessed malicious domain name into multiple domain tags, calculate the hash value for each domain tag, and perform hash calculation on the hash value of the domain tags again according to the number of domain tags to obtain a combined hash value; The information table storage module is configured to: create multiple malicious domain name information tables and malicious IP information tables in the programmable data plane, and send the combined hash value and the preprocessed malicious IP address to the malicious domain name information table and malicious IP information table in the programmable data plane; The matching and detection module is configured to: receive network traffic data packets in the programmable data plane and identify them to determine whether the data packets are domain name resolution data packets or ordinary IP packets; If it is a domain name resolution data packet, then perform domain name resolution, extract domain name information, calculate the combined hash value of the extracted domain name information, match it with the malicious domain name information table, and execute the preset action according to the matching result; If it is a regular IP packet, it is matched against the malicious IP information table. If the match is the same, a digest is generated based on the content of the regular IP packet and sent to the control plane. Otherwise, the regular IP packet is further detected and analyzed to complete the APT network threat classification detection.

[0023] The beneficial effects of this invention are as follows: 1. High performance: By performing IOC detection directly in the programmable data plane, the bottleneck of control plane processing is avoided, enabling real-time detection of large-scale traffic.

[0024] 2. Low latency: The detection logic is embedded in the forwarding path, eliminating the need for additional reporting or copying, thus significantly reducing detection latency.

[0025] 3. Tiered detection: The hash matching mechanism based on domain tags can make accurate judgments step by step according to the level, improving the accuracy of malicious domain name detection.

[0026] 4. Dynamic Adaptation: The control plane can combine external intelligence sources to generate and issue new rules in real time, enhancing the flexibility and effectiveness of APT defense.

[0027] 5. Scalability: This solution is not only applicable to APT threat detection, but can also be extended to other IOC-based threat identification scenarios. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the programmable data plane structure of the present invention; Figure 2 This is a schematic diagram of the control plane structure of the present invention; Figure 3 This is a schematic diagram of the domain name resolution process of the present invention; Figure 3 The diagram in the middle (a) illustrates the domain name resolution process for the character "a". Figure 3 The diagram in the middle (b) illustrates the domain name resolution process for the character "b". Figure 3 The diagram (c) illustrates the domain name resolution process for the character "c". Figure 3The diagram in (d) illustrates the domain name resolution process for the character "example". Detailed Implementation

[0029] The present invention will be further described below with reference to the embodiments and accompanying drawings, but is not limited thereto.

[0030] Example 1: A method for graded detection of APT network threats based on a programmable data plane, such as Figure 1-3 As shown, it includes: Step 1: The control plane obtains malicious domain names and malicious IP addresses and performs preprocessing; Step 2: Segment the preprocessed malicious domain name into multiple domain tags, calculate the hash value for each domain tag, and perform hash calculation on the hash value of the domain tags again according to the number of domain tags to obtain the combined hash value; Step 3: The programmable data plane creates multiple malicious domain name information tables and malicious IP information tables, and sends the combined hash value and the preprocessed malicious IP address to the malicious domain name information tables and malicious IP information tables in the programmable data plane; Step 4: The programmable data plane receives and identifies network traffic data packets, determining whether the data packets are domain name resolution data packets or ordinary IP packets; If it is a domain name resolution data packet, then perform domain name resolution, extract domain name information, calculate the combined hash value of the extracted domain name information, match it with the malicious domain name information table, and execute the preset action according to the matching result; If it is a regular IP packet, it is matched against the malicious IP information table. If the match is the same, a digest is generated based on the content of the regular IP packet and sent to the control plane. Otherwise, the regular IP packet is further detected and analyzed to complete the APT network threat classification detection.

[0031] Example 2: The difference between the APT network threat classification detection method based on a programmable data plane described in Example 1 and the method described in Example 1 is as follows: The control plane acquires malicious domain names and malicious IP addresses and performs preprocessing, including: The control plane periodically (set to a range of every 5 minutes to every hour, depending on the APT threat intelligence source update rate and security policy requirements) retrieves malicious domain names and malicious IP addresses from the APT threat intelligence source; APT threat intelligence sources continuously provide real-time data streams on network threat information, including IOC information related to APT activities, namely malicious domain names and malicious IP addresses. These APT threat intelligence sources can be open-source community-driven platforms (such as AlienVault OTX, Abuse.ch URLhaus) or commercial subscription services (such as CrowdStrike FalconIntelligence, Mandiant Threat Intelligence). Preprocess the acquired malicious domain names and malicious IP addresses, including data deduplication and risk classification; Data deduplication includes: after receiving malicious domain names and malicious IP addresses, deleting duplicate entries and retaining only unique malicious domain names and malicious IP addresses for subsequent processing; this eliminates duplicate IOC entries from different intelligence sources; for example, if three intelligence sources all mark evil.com as malicious, the system will only process it as a unique IOC, which helps optimize the limited storage resources of the programmable data plane. Risk grading includes: after data deduplication, assigning a risk level (e.g., high, medium, low) to each unique malicious domain name and malicious IP address based on the data source. High risk: domain names known to be associated with C2 servers of state-sponsored APT organizations, or information from multiple APT intelligence sources; low risk: domain names hosting adware, or information from a single APT intelligence source; or specifying the risk level of a malicious domain name or malicious IP address based on demand strategies.

[0032] Step 2 is as follows: Malicious domains with specified risk levels are segmented according to requirements (e.g., administrators only need to distribute high-risk malicious domains to the data plane). This is done by using the domain name separator (e.g., "." as the separator) as the basis to segment malicious domains with specified risk levels into multiple domain tags, forming a domain tag sequence (e.g., for the domain name "abcexample.com", "." is used as the separator to segment it, resolving it into the domain tag sequence [a][b][c][example][com]). Calculate the hash value independently for each domain tag in the domain tag sequence to generate a domain hash sequence of length MAX_LABLE (length 8). If the number of domain tags is insufficient, pad with zeros. If MAX_LABEL=8, each field label is processed using the CRC32 algorithm to obtain a corresponding 4-byte hash value, such as: h1 = CRC32(a); h2 = CRC32(b); h3 = CRC32(c); h4 = CRC32(example); h5 = CRC32(com); h6 = CRC32(0); h7 = CRC32(0); h8 = CRC32(0); This forms the domain hash sequence [h1, h2, h3, h4, h5, h6, h7, h8]; Based on the number of domain levels N, i.e., the number of domain tags (e.g., abcexample.com has 5 levels), concatenate one to N adjacent hash values ​​in the domain hash sequence and calculate the hash value to obtain combined hash values ​​L1_hash, L2_hash, ..., LN_hash at different levels; where L1_hash represents the combined hash value calculated from a single hash value in the domain hash sequence, and LN_hash represents the combined hash value calculated by concatenating N adjacent hash values ​​in the domain hash sequence. Calculating the combined hash value based on domain level N=5: L1_hash=CRC32(h5) (matches top-level fields); L2_hash=CRC32(h4,h5) (matches "example.com"); L3_hash=CRC32(h3,h4,h5) (matches "c.example.com"); L4_hash=CRC32(h2,h3,h4,h5) (matches "bcexample.com"); L5_hash=CRC32(h1,h2,h3,h4,h5) (matches "abcexample.com"); A further preferred algorithm for calculating the hash value is the CRC32 algorithm.

[0033] Step 3 specifically involves: The programmable data plane creates multiple (8) malicious domain name information tables and 1 malicious IP information table; Based on the IOC requirements, specify the matching level n (e.g., for exact matching of all domains, matching level n=N; for fuzzy matching of two domain tags, matching level n=2), and send the combined hash value Ln_hash of the corresponding level number n, n∈[1,N], to the malicious domain information table in the programmable data plane. For example, if this IOC needs to precisely match the malicious DNS packet of the domain "abcexample.com", then L5_hash is sent to the malicious domain information table at level L5. If this IOC needs to fuzzily match the malicious DNS packet of the domain "*.bcexample.com", then L4_hash is sent to the malicious domain information table at level L4. If this IOC needs to fuzzily match the malicious DNS packet of the domain "*.c.example.com", then L3_hash is sent to the malicious domain information table at level L3, and so on. At the same time, based on the requirements, malicious IP addresses with specified risk levels are sent to the malicious IP information table in the programmable data plane. The malicious domain information table includes the following entries: key_hash: Combined hash value, used to store combined hash values ​​Ln_hash, such as L1_hash, L2_hash, L3_hash, L4_hash, L5_hash; ioc_id_name: Malicious domain sequence number, used to store the sequence number value of malicious domains (a unique malicious domain sequence number automatically generated when obtaining information from APT threat intelligence sources), and used for reporting when a malicious domain information table is hit; level_name: The level number of the combined hash value, used to store the corresponding level number n, which is used to indicate which level of the malicious domain information table to send it to; tm_name: Domain name timestamp, used to store the time when the table entry for the combined hash value was issued; The malicious IP information table includes the following entries: IP: Malicious IP address, used to store malicious IP addresses, and is the basis for matching ordinary IP packets; ioc_id_IP: Malicious IP address sequence number, used to store the malicious IP address sequence number (a unique malicious IP sequence number automatically generated when obtaining information from APT threat intelligence sources), and used for reporting when the malicious IP information table is hit; level_IP: Represents a malicious IP information table for the programmable data plane, used to store the fixed value Level_IP; tm_IP: IP timestamp, used to store the time when a malicious IP address was issued as an entry.

[0034] The programmable data plane receives and identifies network traffic data packets, determining whether they are domain name resolution packets or ordinary IP packets; including: The programmable data plane receives network traffic from the switch port, identifies the protocol header of the data packets in the network traffic, that is, reads the Ethernet header and IP header in the data packets, and checks the transport layer header (TCP or UDP). If the destination port or source port is 53, the data packet is identified as a DNS data packet, that is, a domain name resolution data packet; otherwise, it is identified as a regular IP packet. If it is a domain name resolution data packet, then domain name resolution is performed, domain name information is extracted, a combined hash value is calculated for the extracted domain name information, and it is matched with a malicious domain name information table. Based on the matching result, preset actions are executed, including: If it is a domain name resolution packet, i.e., a DNS packet, then the domain name field is obtained from the DNS packet (DNS message). The domain name field includes multiple domain label fields. For each domain tag field, read the first byte, which is the length of the domain tag field. If the value is zero, the domain name resolution ends. If it is not zero, the length counter is set to the length of the field label field, and the corresponding byte header type is selected according to the length of the field label field. The byte header types include 32 bytes, 16 bytes, 8 bytes, 4 bytes, 2 bytes, and 1 byte. Extract the content of the field label field according to the number of bytes in the byte header type. If the length of the field label field is equal to the number of bytes in the byte header type, then the byte header type with the corresponding number of bytes is selected for direct extraction, and the length counter is updated (the length counter is reduced by the corresponding number of characters after the number of characters extracted). If the length of the field label field is between the number of bytes of two header types, the header type with the smaller number of bytes is selected to extract the corresponding number of bytes in the field label field, and the length counter is updated. Then, the header type is selected until the content of the field label field is completely extracted, i.e., the length counter is 0, and the next field label field is read. If the length of the field label field is greater than the maximum number of bytes in the byte header type, then the byte header type with the maximum number of bytes is selected and the same extraction operation is performed until the length counter is 0, and then the next field label field is read. Repeat the above operation to extract the domain tag field content. If the read value is zero, the domain name resolution is over and the complete domain tag, i.e., the domain information, is obtained (e.g., "abcexample", with domain tags a, b, c, and example respectively).

[0035] For example, the domain name field is 01 61 01 62 01 63 07 65 78 61 6d 70 6c 65 00, where 01 indicates that the following byte is the domain label (i.e., "a"), 61 is the ASCII code of "a", which is the domain label field, 01 62 is the second-level domain label "b", 01 63 is the third-level domain label "c", 07 65 78 61 6d 70 6c 65 is the fourth-level domain label "example", and 00 is the terminator, indicating the end of the domain name field; If the field tag "example" is read, the first byte 07 indicates that the field tag length is 7 characters. Set the length counter to 7, select the byte header type as 4 bytes, and store "exam". The remaining 3 bytes are "ple". Update the length counter to 3, select the byte header type as 2 bytes, and store "pl". Update the length counter to 1, select the byte header type as 1 byte, and store "e". The length counter is 0, and the parsing of this field tag ends. Read the subsequent field tag bytes, which are 00, and the parsing ends.

[0036] Calculate the hash value independently for each domain tag in the domain name information to generate a domain hash sequence; based on the specified matching level n (e.g., exact match of all domain names, or wildcard fuzzy match), combine the hash values ​​from the adjacent n domain hash sequences and calculate the hash value (e.g., if the matching level is fuzzy match, only the level "*.example.com" needs to be matched, then the matching key is L2_hash). If the combination is insufficient, fill with zero values ​​to obtain the combined hash value, which is then used as the matching key. L1_hash=CRC32(h5) (matches top-level fields); L2_hash=CRC32(h4,h5) (matches "example.com"); L3_hash=CRC32(h3,h4,h5) (matches "c.example.com"); L4_hash=CRC32(h2,h3,h4,h5) (matches "bcexample.com"); L5_hash=CRC32(h1,h2,h3,h4,h5) (matches "abcexample.com"); The matching key is used to match malicious domain name information tables at all levels in the programmable data plane. If a certain combined hash value, i.e., the matching key, is the same as the value of a malicious domain name information table at a certain level, then the DNS packet is determined to have hit a malicious IOC rule; otherwise, the DNS packet is determined to have not hit a malicious IOC rule. Based on the matching results, a preset action is executed. That is, when the matching result is a match for a malicious IOC rule, the malicious domain information table is read and a packaged packet {ioc_id_name, tm_name, matched_hash, original_packet_payload} is generated. Here, ioc_id_name represents the malicious domain sequence number, tm_name represents the domain timestamp, matched_hash represents the currently matched key, and original_packet_payload represents the entire content of the matched DNS packet. The generated encapsulated message is sent to the control plane (monitoring port UDP_PORT_REPORT=4000). After receiving the encapsulated message, the control plane writes it into the APT event database (as an APT threat intelligence source) and updates the malicious domain information table. If the matching result is a no-match with a malicious IOC rule, the DNS message or copy is forwarded to an external deep analysis engine for further detection and analysis (e.g., Zeek software, an open-source network monitoring software mainly used to monitor and analyze network traffic, check the complete payload of data packets, identify known attack signatures or sensitive data leaks; analyze the behavioral characteristics of data packets over a long period of time, and detect the presence of slow and abnormal activities common in APT attacks). Based on the detection and analysis results, new preset rules, i.e., new matching levels, are generated, the malicious domain information table is dynamically updated, and the information is sent to the programmable data plane.

[0037] The system matches ordinary IP packets against a malicious IP information table. If the match is the same, a digest of the ordinary IP packet content is generated and sent to the control plane; otherwise, the ordinary IP packet undergoes further detection and analysis, including: The programmable data plane receives ordinary IP packets and obtains the source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port, IP protocol field, and IP packet length from the ordinary IP packets; If the source IP address or destination IP address is the same as the malicious IP address in the malicious IP information table, it is determined that the malicious IOC address information has been hit; otherwise, it is determined that the malicious IOC address information has not been hit. If it is determined that a malicious IOC address has been hit, a digest message is generated and sent to the control plane; The summary message includes {ioc_id_IP, tm_IP, Flow_ID, source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port, IP protocol field, IP packet length}; Here, Flow_ID represents the CRC32 checksum. Metadata A and Metadata B are created. Metadata A includes {source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port}. The smaller of the source IP address and destination IP address is assigned to the ip_a field in Metadata B, and the larger one is assigned to the ip_b field. The transport layer protocol is directly assigned to the proto field in Metadata B. The smaller of the transport layer destination port and transport layer source port is assigned to the port_a field in Metadata B, and the larger one is assigned to the port_b field, resulting in Metadata B {ip_a, ip_b, proto, port_a, port_b}. The CRC32 checksum is then calculated using the CRC32 algorithm. After receiving the summary information, the control plane writes it into the APT event database (as a source of APT threat intelligence) and updates the malicious IP information table. If a malicious IOC address is not found, the programmable data plane forwards the ordinary IP packet to an external deep analysis engine for further detection and analysis; based on the detection and analysis results, the malicious IP information table is dynamically updated and sent to the programmable data plane.

[0038] Table 1 Malicious Domain List Table 2 Malicious IP Address Table Malicious domain names and malicious IP addresses are shown in Tables 1 and 2, where L1hash is the hash value of the malicious domain name and IP is the malicious IP address.

[0039] Example 3: A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the APT network threat classification and detection method based on a programmable data plane as described in Embodiment 1 or 2.

[0040] Example 4: A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the APT network threat classification and detection method based on a programmable data plane as described in Embodiment 1 or 2.

[0041] Example 5: An APT network threat classification and detection system based on a programmable data plane includes: The IOC information processing module is configured to: obtain malicious domain names and malicious IP addresses from the control plane and perform preprocessing; The hash calculation module is configured to: split the preprocessed malicious domain name into multiple domain tags, calculate the hash value for each domain tag, and perform hash calculation on the hash value of the domain tags again according to the number of domain tags to obtain a combined hash value; The information table storage module is configured to: create multiple malicious domain name information tables and malicious IP information tables in the programmable data plane, and send the combined hash value and the preprocessed malicious IP address to the malicious domain name information table and malicious IP information table in the programmable data plane; The matching and detection module is configured to: receive network traffic data packets in the programmable data plane and identify them to determine whether the data packets are domain name resolution data packets or ordinary IP packets; If it is a domain name resolution data packet, then perform domain name resolution, extract domain name information, calculate the combined hash value of the extracted domain name information, match it with the malicious domain name information table, and execute the preset action according to the matching result; If it is a regular IP packet, it is matched against the malicious IP information table. If the match is the same, a digest is generated based on the content of the regular IP packet and sent to the control plane. Otherwise, the regular IP packet is further detected and analyzed to complete the APT network threat classification detection.

Claims

1. A method for APT network threat classification detection based on programmable data plane, characterized in that, Comprise: Step 1: control plane acquires malicious domain name and malicious IP address, and pretreatment is carried out; Step 2: the malicious domain name after pretreatment is cut into multiple domain labels, the hash value of each domain label is calculated, and the hash value of the domain label is calculated again according to the number of domain labels, and the combined hash value is obtained; Step 3: programmable data plane creates multiple malicious domain name information table and malicious IP information table, sends the combined hash value and the pretreated malicious IP address to the malicious domain name information table and the malicious IP information table of the programmable data plane; Step 4: programmable data plane receives network traffic data packet and identifies, judges the data packet to be domain name resolution data packet or normal IP packet; If it is domain name resolution data packet, domain name resolution is carried out, domain name information is extracted, combined hash value is calculated for the extracted domain name information, and matching is carried out with the malicious domain name information table, and preset action is executed according to the matching result; If it is normal IP packet, matching is carried out with the malicious IP information table, if the matching result is the same, the summary information is generated according to the content of the normal IP packet and sent to the control plane, otherwise the normal IP packet is further detected and analyzed, and APT network threat grading detection is completed.

2. The APT network threat grading detection method based on programmable data plane according to claim 1, characterized in that, The control plane acquires malicious domain name and malicious IP address, and pretreatment is carried out;Comprise: The control plane acquires malicious domain name and malicious IP address periodically; The acquired malicious domain name and malicious IP address are pretreated, including data deduplication and risk grading; Among them, data deduplication includes: after receiving the malicious domain name and the malicious IP address, deleting the repeated entries, and only keeping the non-repeated malicious domain name and the malicious IP address; Risk grading includes: after data deduplication, a risk level is assigned to each unique malicious domain name and malicious IP address according to the data source, or the risk level of a certain malicious domain name or malicious IP address is specified according to the demand strategy.

3. The APT network threat grading detection method based on programmable data plane according to claim 2, characterized in that, Step 2 specifically is: According to the demand, the malicious domain name with specified risk level is cut, that is, the malicious domain name with specified risk level is cut into multiple domain labels according to the domain name separator, forming a domain label sequence; The hash value of each domain label in the domain label sequence is calculated independently, a domain hash sequence with a length of MAX_LABLE is generated, and if the number of domain labels is insufficient, it is filled with zero; According to the number of domain levels N, that is, the number of domain labels cut, one to N adjacent hash values in the domain hash sequence are spliced, and the hash value is calculated to obtain the combined hash values of different levels L1_hash, L2_hash,..., LN_hash;Among them, L1_hash represents the combined hash value calculated by one hash value in the domain hash sequence, and LN_hash represents the combined hash value calculated by splicing N adjacent hash values in the domain hash sequence; Further preferably, the algorithm for calculating the hash value is CRC32 algorithm.

4. The APT network threat grading detection method based on programmable data plane according to claim 3, characterized in that, Step 3 specifically is: The programmable data plane creates multiple malicious domain name information table and 1 malicious IP information table; According to the IOC requirements, the matching level n is specified, the combined hash value L n_hash corresponding to the level number n is issued to the malicious domain name information table of the programmable data plane, n∈[1, N], and at the same time, according to the requirements, the malicious IP address of the specified risk level is issued to the malicious IP information table of the programmable data plane; For the malicious domain name information table, the issued table entries include: key_hash: combined hash value; ioc_id_name: malicious domain name serial number; level_name: level number of combined hash value; tm_name: domain name timestamp; For the malicious IP information table, the issued table entries include: IP: malicious IP address; ioc_id_IP: malicious IP address serial number; level_IP: malicious IP information table of programmable data plane; tm_IP: IP timestamp.

5. The APT network threat grading detection method based on programmable data plane according to claim 4, characterized in that, The programmable data plane receives network traffic data packets and identifies them, and judges whether the data packets are domain name resolution data packets or ordinary IP packets; Including: The programmable data plane receives network traffic from the switch port, identifies the protocol header of the data packet in the network traffic, that is, reads the Ethernet header and IP header in the data packet, and checks the transport layer header, if the destination port or source port is 53, the data packet is judged as a DNS data packet, that is, a domain name resolution data packet; otherwise, it is judged as an ordinary IP packet.

6. The APT network threat grading detection method based on programmable data plane according to claim 5, characterized in that, If it is a domain name resolution data packet, perform domain name resolution, extract domain name information, calculate the combined hash value of the extracted domain name information, and match it with the malicious domain name information table, and execute the preset action according to the matching result; including: If it is a domain name resolution data packet, that is, a DNS data packet, the domain name field is obtained from the DNS data packet, which includes multiple domain label fields; For each domain label field, read the first byte, which is the length of the domain label field, if the value is zero, the domain name resolution ends; If it is not zero, set the length counter to the length of the domain label field, select the corresponding byte header type according to the length of the domain label field, the byte header type includes 32 bytes, 16 bytes, 8 bytes, 4 bytes, 2 bytes, 1 byte; According to the number of bytes of the byte header type, the content of the domain label field is extracted, wherein if the length of the domain label field is equal to the number of bytes in a certain byte header type, the corresponding byte header type is selected to extract directly, and the length counter is updated; If the length of the domain label field is between the number of bytes of two byte header types, select the byte header type with the smaller number of bytes to extract the content of the corresponding number of bytes in the domain label field, and update the length counter, then continue to select the byte header type until the domain label field content is extracted, that is, the length counter is 0, and the next domain label field is read; If the length of the domain label field is greater than the maximum number of bytes in the byte header type, the same extraction operation is performed on the byte header type with the maximum number of bytes until the length counter is 0, and the next domain label field is read; Repeat the above extraction operation of the domain label field content, if the read value is zero, the domain name resolution ends, and the complete domain label, that is, the domain name information, is obtained; Hash values are independently calculated for each domain label in the domain name information to generate a domain hash sequence; according to a specified matching level n, the hash values in adjacent n domain hash sequences are combined, and a hash value is calculated, and when the combination is insufficient, a zero value is filled, to obtain a combined hash value as a matching key: The matching key is used to match all levels of malicious domain name information tables in the programmable data plane, if a combined hash value, i.e. the matching key, is the same as the value of a malicious domain name information table at a certain level, it is judged that the DNS packet hits the malicious IOC rule; otherwise, it is judged that the DNS packet does not hit the malicious IOC rule; Based on the matching result, a preset action is executed, i.e. when the matching result is a hit malicious IOC rule, the malicious domain name information table is read to generate an encapsulation packet {ioc_id_name, tm_name, matched_hash, original_packet_payload}, wherein ioc_id_name represents the malicious domain name sequence number, tm_name represents the domain name timestamp, matched_hash represents the currently matched matching key, and original_packet_payload represents the entire content of the matched DNS packet; The generated encapsulation packet is sent to the control plane, and the control plane writes the encapsulation packet into the APT event database and updates the malicious domain name information table after receiving the encapsulation packet; If the matching result is a miss malicious IOC rule, the DNS packet or copy is forwarded to an external deep analysis engine for further detection and analysis, and based on the detection and analysis result, a new preset rule, i.e. a new matching level, is generated to dynamically update the malicious domain name information table and send it to the programmable data plane.

7. The APT network threat grading detection method based on programmable data plane according to claim 6, characterized in that, The normal IP packet is matched with the malicious IP information table, and if the matching result is the same, the summary information is generated according to the content of the normal IP packet and sent to the control plane, otherwise the normal IP packet is further detected and analyzed; It comprises: The programmable data plane receives the normal IP packet, obtains the source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port, IP protocol field and IP packet length in the normal IP packet; If the source IP address or destination IP address is the same as the malicious IP address in the malicious IP information table, it is judged as a hit malicious IOC address information; otherwise, it is judged as a miss malicious IOC address information; If it is judged as a hit malicious IOC address information, a summary message is generated and sent to the control plane; The summary message comprises {ioc_id_IP, tm_IP, Flow_ID, source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port, IP protocol field, IP packet length}; Wherein, Flow_ID represents CRC32 checksum, that is, creating metadata A and metadata B, metadata A includes {source IP address, destination IP address, transport layer protocol number, transport layer destination port, transport layer source port}, the smaller one of the source IP address and the destination IP address is assigned to the ip_a field in the metadata B, and the larger one is assigned to the ip_b field in the metadata B; the transport layer protocol is directly assigned to the proto field in the metadata B, the smaller one of the transport layer destination port and the transport layer source port is assigned to the port_a field in the metadata B, and the larger one is assigned to the port_b field in the metadata B, to obtain the metadata B {ip_a, ip_b, proto, port_a, port_b}, and the CRC32 algorithm is used to calculate the metadata B to obtain the CRC32 checksum; The control plane writes the digest information into the APT event database after receiving the digest information, and updates the malicious IP information table; If it is judged that the malicious IOC address information is not hit, the programmable data plane forwards the normal IP packet to the external deep analysis engine for further detection and analysis; the malicious IP information table is dynamically updated based on the detection and analysis results, and is sent to the programmable data plane.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the APT network threat hierarchical detection method based on the programmable data plane according to any one of claims 1-7.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the APT network threat hierarchical detection method based on the programmable data plane according to any one of claims 1-7.

10. An APT cyber threat classification detection system based on programmable data plane, characterized in that, It comprises: The IOC information processing module is configured to control the plane to obtain malicious domain names and malicious IP addresses, and to preprocess them; The hash calculation module is configured to split the preprocessed malicious domain names into multiple domain tags, calculate the hash value of each domain tag, and perform hash calculation again on the hash value of the domain tag according to the number of domain tags to obtain a combined hash value; The information table storage module is configured to create multiple malicious domain name information tables and malicious IP information tables in the programmable data plane, and send the combined hash value and the preprocessed malicious IP address to the malicious domain name information table and the malicious IP information table in the programmable data plane; The matching detection module is configured to receive network traffic data packets and identify them in the programmable data plane, and judge whether the data packets are domain name resolution data packets or normal IP packets; If they are domain name resolution data packets, domain name resolution is performed, domain name information is extracted, a combined hash value is calculated for the extracted domain name information, and matching is performed with the malicious domain name information table, and a preset action is performed according to the matching result; If they are normal IP packets, matching is performed with the malicious IP information table, if the matching result is the same, digest information is generated according to the content of the normal IP packet and is sent to the control plane, otherwise, the normal IP packet is further detected and analyzed, and APT network threat hierarchical detection is completed.

Images