TCP Packet Forgery Detection via Window Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting forged TCP packets are either too complex or have low accuracy, leading to misjudgments and omissions, necessitating a more efficient and accurate processing method to enhance network safety.
Innovation Solution
A method utilizing the window size field and receive window scaling factor from the TCP packet header to calculate the receive window value and compare it with actual values stored in a TCP receive window reference table, determining deviations to identify forged packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If simplified processing methods are used to detect forged TCP packets, then the implementation is easier, but the detection accuracy is low leading to misjudgments or omissions
Solution Approach 1:
The patent pre-calculates and stores the receive window scaling factor in a reference table during the TCP three-way handshake phase. This preliminary action allows the detection phase to simply compare the window size field against pre-computed expected values, achieving high accuracy without complex real-time calculations. The reference table is populated with tuples containing source IP, destination IP, source port, destination port, and the pre-calculated receive window scaling factor.
Solution Approach 2:
The system uses the TCP protocol's own window scaling mechanism to detect forged packets. By leveraging the receive window scaling factor that is already part of the TCP handshake, the system creates a self-validating detection mechanism where the protocol's inherent features are used to verify packet authenticity, eliminating the need for external complex verification systems.
2Measurement precision
If complex detection methods are used to improve detection accuracy, then the accuracy improves, but the implementation becomes too complicated
Solution Approach 1:
The patent pre-calculates and stores the receive window scaling factor in a reference table during the TCP three-way handshake phase. This preliminary action allows the detection phase to simply compare the window size field against pre-computed expected values, achieving high accuracy without complex real-time calculations. The reference table is populated with tuples containing source IP, destination IP, source port, destination port, and the pre-calculated receive window scaling factor.
Solution Approach 2:
The patent extracts the receive window scaling factor from the TCP handshake process and stores it separately in a reference table. This extraction allows the detection system to focus solely on comparing the window size field against pre-computed values without needing to re-implement the entire TCP window scaling calculation logic, thereby simplifying the detection system while maintaining accuracy.
3Productivity
If simple processing is used for detecting forged TCP packets, then the processing speed is faster, but the accuracy is low leading to misjudgment or omission
Solution Approach 1:
The patent pre-calculates and stores the receive window scaling factor in a reference table during the TCP three-way handshake phase. This preliminary action allows the detection phase to simply compare the window size field against pre-computed expected values, achieving high accuracy without complex real-time calculations. The reference table is populated with tuples containing source IP, destination IP, source port, destination port, and the pre-calculated receive window scaling factor.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The present disclosure provides a method and a system for processing forged TCP packets. More specifically, the present disclosure utilizes a window size field in a header of a to-be-processed TCP packet and a window scaling factor to calculate a receive window value of the TCP packet for comparison with an actual receive window value. Further, based on a degree of deviation between the comparison result and a threshold, whether the to-be-processed TCP packet is forged is determined, such that the probability of finding and discarding the forged TCP packet is improved.