CN115664833A - Network hijacking detection method based on local area network security equipment - Google Patents

Abstract

The invention relates to computer communication and network security technology. In order to realize hijacking detection by using multi-layer protocol header fields, and subdivide various hijacking situations; it can detect the data flow in the network in real time, and the system resource consumption is small; no need to rely on other network resources Or establish a database of normal information in advance to detect whether there is hijacking. The technical scheme adopted by the present invention is a network hijacking detection method based on a LAN security device, the steps are as follows: detecting data packet header information, recording the data packet header information, matching rules, and obtaining detection results. The present invention is mainly applied to network communication security occasions.

Description

Network hijacking detection method based on LAN security equipment

technical field

The invention relates to computer communication and network security, in particular to a network hijacking detection method based on local area network security equipment.

Background technique

With the rapid development of the Internet, the problem of network hijacking has become more and more serious. Network traffic hijacking can be classified into hijacking within the LAN and hijacking outside the LAN. At present, the hijacking of plaintext transmission outside the LAN is mainly the hijacking. Entering malicious data, so that users cannot get normal network services or even damage user equipment. For example, the content of the website visited by the user cannot be displayed normally, the target website cannot be accessed, or the application fails to run due to an error. Attackers mainly target TCP (Transmission Control Protocol) connections and HTTP (Hypertext Transfer Protocol) connections built on top of TCP. These connections are transmitted in plain text, and by forging legal data packets, the user host will process the received data incorrectly. received message. Although many vendors on the Internet currently use encrypted transmission protocols to interact with users, a large part of them are still transmitted in plain text, so it is still very important and meaningful to detect session hijacking for this part.

The current session hijacking attack detection methods for plaintext transmission mainly include:

Detection method 1: Use web crawler technology to crawl the IP and port numbers of proxy servers in various regions, configure the browser to use the proxy server to access the target website and record the content of the website, and then access the target website without using the proxy server, and compare whether the content has changed before and after , if there is, it proves the existence of hijacking. (Patent No. 201410403660.4)

Detection method 2: Count the network flows corresponding to each IP within a period of time in the core routing network, and record the TTL value and IPID number changes of each data packet. If it exceeds the set threshold and reaches a certain number, it is judged that there is hijacking. (Patent No. 201710112616.1)

Detection method 3: Detect whether the user's webpage is abnormal. If so, take a screenshot to save the interface content, obtain the detection data and perform ping operations on them one by one, and submit the ping packet loss rate, screenshot content and result log to the server for model detection. This is to determine whether it is a network hijacking. (Patent No. 202010567944.2)

Research status of related technologies

For the above detection method 1, it is necessary to access the normal data with the help of network resources in other regions, and compare the data obtained through this network access with the normal data to know whether it has been hijacked. If other networks are also hijacked, then It is not possible to determine whether this network has been hijacked. and cannot be detected in real time.

For the above-mentioned detection method 2, the detection tool is arranged at the core routing network node, which can only distinguish the data flow for each port above the IP but not for the IP. The current TCP/IP protocol stack has started from assigning separate IPID counters based on different IPs for IPID value generation. In 2014, in Linux 3.16, kernel developers realized that there are performance issues with using separate counters for each IP destination. So global incrementing counters are not advisable, they took a hybrid approach consisting of 2048 globally incrementing counters. To determine which counter to use for an IP datagram, the destination address of that datagram is hashed with a secret value randomly generated at system startup. The resulting hash (mod 211) is used to determine the index of the counter. Each counter is 32 bits to accommodate IPv6, and for IPv4, the IPID is extracted from the lower 16 bits of the counter.

The generated IPID value does not increase linearly, each time a counter is used to assign an IPID, instead of incrementing it by 1, the kernel adds a number evenly distributed between 1 and the number of system ticks since the counter was last used. For the IPv6 version of the TCP data packet, its IPID does not necessarily exist. If the byte size of the IPv6 data packet does not trigger the fragmentation operation, the TCP/IP protocol stack does not assign an IPID value to it. It can be seen from this that the data packet sending interval is unpredictable and has a large difference, and the generated IPID value fluctuates greatly. And the IPID value does not necessarily exist in every TCP datagram.

Because the IPID value has become unpredictable, and more and more manufacturers have used the new TCP/IP protocol stack, the effect of TCP hijacking detection based on this dimension will become worse. In addition, it is necessary to collect the information of each IP data flow within a period of time, which consumes a lot of system resources, and does not subdivide the specific transport layer port number of each IP for classification and identification, which will lead to too many false positives and cannot detect hijacking in real time.

For the above detection method 3, it is necessary to establish a knowledge base for normal access in advance, and the server can know whether it has been hijacked through comparison. The establishment of the knowledge base requires a lot of energy, and it is difficult to update the changes of each website in real time. Over time, the detection effect will decrease.

Contents of the invention

For overcoming the deficiencies in the prior art, the present invention aims to realize:

1. Use multi-layer protocol header fields for hijacking detection and subdivide various hijacking situations.

2. It can detect the data flow in the network in real time, and the system resource consumption is small.

3. There is no need to rely on other network resources or establish a database of normal information in advance to detect whether there is hijacking.

For this reason, the technical scheme that the present invention takes is, the network hijacking detection method based on LAN security equipment, the steps are as follows: data packet header information detection, record data packet header information, rule matching, draw detection result.

The detailed steps are as follows:

(1) Utilize the firewall device to filter non-TCP protocols and HTTP protocol packets based on the TCP protocol, carry out deep packet analysis of the obtained data packets, and extract the header field information of the network layer and the application layer;

It mainly includes: source IP, source port number, destination IP, destination port number, TTL value, Flags information bit of TCP layer and HTTP response status code;

(2) sort out the obtained header field information, generate entry information, and subsequently determine whether to update the entry information in the cache or save the entry information in the cache;

1) Initially, the entry information of the system is empty, and the newly arrived data packet directly saves the entry information in the cache according to its quadruple information, and the quadruple information structure is as follows:

Quad = (Src_IP, Src_port, Dst_IP, Dst_port)

Among them, Src_IP represents the source IP, Src_port represents the source port, Dst_IP represents the destination IP, and Dst_port represents the destination port

2) The cache is not empty, it is necessary to judge whether the quadruple information in the newly generated entry information already exists in the cache, if not, then directly save the newly generated entry information in the cache, otherwise, the newly generated The entry information is compared with the TTL value of the entry information in the corresponding cache, and the following judgments are made:

(a) If the absolute value of the comparison exceeds the threshold, it is considered to be an abnormal conversation flow, and subsequent judgments are required to refine various situations;

(b) If the absolute value of the comparison does not exceed the threshold, it is considered that the current session flow is normal, and the TTL value of the corresponding entry information in the cache needs to be updated;

The generation formula of TTL_Mean is as follows:

TTL_Mean＝(TTL_Mean*(n-1)+TTL)/n

The formula for calculating the newly generated TTL value is as follows:

为向下取整，TTL_Mean为该条数据流的TTL平均值，TTL为新生成条目TTL值，n为当前数据流包的总数；Where New_TTL is an integer,

For rounding down, TTL_Mean is the average TTL value of the data flow, TTL is the TTL value of the newly generated entry, and n is the total number of current data flow packets;

3) The setting of the threshold requires actual statistical observation, and there are two methods as follows:

(a): Comparing the range of multiple data streams, if the range of a stream is very small, then it is considered that this data stream has not been hijacked by an attack; otherwise, it can be considered as a hijacking attack; During data interaction, by setting the content of the server’s return packet, check whether the content has been changed before and after, and observe the change of the TTL of the data stream to determine whether it has been hijacked;

(b): By visiting the website, observe whether the correct content is returned, whether there is malicious advertisement implanted, whether it jumps to other irrelevant webpages, observe the change of data flow TTL, and judge whether it has been hijacked, considering the current network environment, Find a suitable size to distinguish between normal data flow and abnormal data flow;

(3) When the TTL exceeds the threshold, the corresponding matching rules for subsequent judgments are established:

1): TCP protocol Flags bit: There are various flag bits in the TCP protocol, and different flag bits represent the status of the current TCP session. Through the change of the Flags bit, we can understand whether the TCP session is normal and what problems occur. The flags status bit:

F: session ended

P: send immediately

A: confirmation bit

R: reset bit

S: sync bit

R: If this field is 1, it is considered that a serious error occurred during the TCP session, end this session, and rebuild a new session;

A TCP packet contains multiple information bits at the same time.

When the Flags information bit is SA, it is considered that the TCP session is hijacked during the handshake process;

·Flags information is FPA, it can be preliminarily considered that there is an abnormality in this session, and it can be further judged by combining the HTTP layer information;

When the Flags information bit is R, it can be considered that the attacker resets the session communication process;

When the Flags information bit is F, it can be preliminarily considered that there is an abnormality in this session, which can be further judged by combining the HTTP layer information;

2): HTTP protocol status code: The status code is the detailed information obtained from the target server. According to different status codes, you can understand the status of the target server and the next operation, and give the status feedback of this data request. Main status code:

200: The page request is successful. 30{0-7}: understood as page redirection.

·The Flags information bit is FPA, and the HTTP status bit is 30{0-7}, then it is judged that some files in the session flow have been hijacked and tampered with;

·If the Flags information bit is F and the HTTP status bit is 200, it is judged that the content of the session has been tampered with by an attacker and the session ends.

Features and beneficial effects of the present invention are:

The invention is mainly aimed at network hijacking detection for local area network security. The intranet client interacts with the Internet server, and the traffic may be hijacked or tampered in the process of returning to the local area network. Part and warning, the invention can achieve the following beneficial effects:

1. Aiming at the current session hijacking behavior on the network, users will not be able to interact with the target server normally, and even cause serious property losses. The invention conducts rule matching through multi-layer protocol information, refines the hijacking behavior, can know the hijacking behavior in detail, and can point out the direction for the follow-up prevention work.

2. For the timeliness of network hijacking detection, this solution is deployed on the firewall that must pass through the incoming and outgoing traffic. As a detection module, it can detect whether each data flow is abnormal in real time, and can issue an alarm in time to avoid greater damage and loss. .

3. In view of the characteristics of the firewall device, the present invention does not occupy many system resources, and the amount of data calculation is small, which belongs to a lightweight detection method and reduces the performance impact on the data forwarding of the firewall.

Description of drawings:

Figure 1 Complete detection flow chart.

FIG. 2 establishes a flow chart of matching rules corresponding to subsequent judgments when the TTL exceeds a threshold.

Figure 3 The current LAN topology.

Figure 4 is a schematic diagram of the program recording and monitoring the status of each session flow.

Figure 5. If the program is hijacked when it is running, it will output a warning log diagram.

Detailed ways

The overall process of this solution mainly includes: detecting data packet header information, recording data packet header information, matching rules, and obtaining detection results.

The complete detection process of the present invention is shown in FIG. 1 .

The method of the present invention is mainly deployed on the firewall device of the local area network as a detection module, and the traffic of the external network enters the local area network and first passes through the firewall, and the traffic arrives at the internal network device after being detected by the firewall. The network administrator can choose whether to enable the detection module according to the current network conditions.

The details are as follows:

(1) The firewall device will filter out non-TCP protocols and HTTP protocol packets based on the TCP protocol, perform deep packet analysis on the obtained data packets, and extract the header field information (if any) of the network layer and application layer. It mainly includes: source IP, source port number, destination IP, destination port number, TTL value, Flags information bit of TCP layer and HTTP response status code (if any).

(2) Arrange the obtained header field information to generate entry information, and subsequently determine whether to update the entry information in the cache or save the entry information in the cache.

1) Initially, the entry information of the system is empty, and the newly arrived data packet directly saves the entry information in the cache according to its quadruple information. The four-tuple information structure is as follows:

Quad = (Src_IP, Src_port, Dst_IP, Dst_port)

Among them, Src_IP represents the source IP, Src_port represents the source port, Dst_IP represents the destination IP, and Dst_port represents the destination port

2) The cache is not empty, it is necessary to judge whether the quadruple information in the newly generated entry information already exists in the cache, if not, then directly save the newly generated entry information in the cache, otherwise, the newly generated The entry information is compared with the TTL value of the entry information in the corresponding cache, and the following judgments are made:

(a) If the absolute value of the comparison exceeds the threshold, it is considered to be an abnormal conversation flow, and subsequent judgments are required to refine various situations.

(b) If the absolute value of the comparison does not exceed the threshold, it is considered that the current session flow is normal, and the TTL value of the corresponding entry information in the cache needs to be updated.

The generation formula of TTL_Mean is as follows:

TTL_Mean＝(TTL_Mean*(n-1)+TTL)/n

The formula for calculating the newly generated TTL value is as follows:

为向下取整，TTL_Mean为该条数据流的TTL平均值，TTL为新生成条目TTL值，n为当前数据流包的总数。Where New_TTL is an integer,

For rounding down, TTL_Mean is the average TTL value of the data flow, TTL is the TTL value of the newly generated entry, and n is the total number of packets in the current data flow.

3) The setting of the threshold requires actual statistical observation, mainly by the following two methods:

(a): Comparing the range of multiple data streams, if the range of one stream is very small, it can basically be considered that this data stream has not been hijacked by an attack; on the contrary, it can be considered as a hijacked attack. During the data interaction of the external network test server, by setting the content of the server’s return packet, checking whether the content has been changed before and after, and observing the change of the TTL of the data stream, it can be judged whether it has been hijacked.

(b): By observing whether the visited website returns correct content, whether there is malicious advertisement implanted, whether it jumps to other irrelevant webpages, and observing the change of data flow TTL, it can be judged whether it has been hijacked. Considering the current network environment, find a suitable size to distinguish normal data flow from abnormal data flow.

(3) When the TTL exceeds the threshold, the corresponding matching rules for subsequent judgments are shown in Figure 2:

1): TCP protocol Flags bit: There are various flag bits in the TCP protocol, and different flag bits represent the status of the current TCP session. Through the change of the Flags bit, you can know whether the TCP session is normal and the problems that occur. Table 1 shows the main Flags status bits:

Table 1

f P A R S session ended send immediately confirmation bit reset bit sync bit

R: If this field is 1, it is considered that a serious error occurred during the TCP session, end this session, and rebuild a new session;

A TCP data packet can contain multiple information bits at the same time.

· If the Flags information bit is SA, it is considered that the TCP session is hijacked during the handshake process.

·Flags information is FPA, it can be preliminarily considered that there is an abnormality in this session, and it can be further judged by combining the HTTP layer information.

· If the Flags information bit is R, it can be considered that the attacker resets the session communication process.

·If the Flags information bit is F, it can be preliminarily considered that there is an abnormality in this session, which can be further judged by combining the HTTP layer information.

2): HTTP protocol status code: The status code is the detailed information obtained from the target server. According to different status codes, you can understand the status of the target server and the next operation, and give the status feedback of this data request. Main status code:

200: The page request is successful. 30{0-7}: It can be understood as page redirection.

·If the Flags information bit is FPA, and the HTTP status bit is 30{0-7}, it can be judged that some files in the session flow have been hijacked and tampered with.

·If the Flags information bit is F and the HTTP status bit is 200, it can be judged that the content of the session has been tampered with by an attacker and the session will end.

The technical solutions of the present invention will be described in detail below in conjunction with the accompanying drawings and specific examples.

The following is a scheme description of an actual example:

Assume that the current LAN topology is as shown in Figure 3.

The incoming and outgoing intranet traffic will be filtered by the firewall. The detection program is deployed on the firewall or the port of the firewall is mirrored, and the traffic is stored on the bypass device, which can be used for non-real-time detection on the bypass device.

Continuously capture the traffic in the live network, and the program records and monitors the status of each session flow, as shown in Figure 4.

The program keeps recording the information of each data stream. If the new data packet detection field does not exceed the threshold, the new TTL value is calculated and stored in the corresponding entry of the system cache. If the header field TTL of the newly arrived data packet exceeds the threshold, Then output the detection results according to the rules set in advance. If the program is hijacked while running, it will output a warning log, as shown in Figure 5.

It can be seen that the present invention can detect different hijacking behaviors, and output the detection results in real time.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. All should be covered within the protection scope of the present invention.

Claims (2)

1. A network hijacking detection method based on local area network security equipment is characterized by comprising the following steps: and detecting the header information of the data packet, recording the header information of the data packet, and obtaining a detection result by rule matching.

2. The method for detecting network hijacking based on local area network security equipment as claimed in claim 1, wherein the detailed steps are as follows:

(1) Filtering a non-TCP protocol and an HTTP (hyper text transport protocol) protocol packet established on the basis of a TCP (transmission control protocol) protocol by using firewall equipment, performing deep packet analysis on the obtained data packet, and extracting header field information of a network layer and an application layer;

the method mainly comprises the following steps: the method comprises the steps of obtaining a source IP, a source port number, a destination IP, a destination port number, a TTL value, a Flags information bit of a TCP layer and an HTTP response state code;

(2) The obtained header field information is sorted to generate entry information, and whether the entry information in the cache needs to be updated or stored in the cache is judged subsequently;

1) Initially, entry information of the system is empty, and a newly-arrived data packet directly stores the entry information in a cache according to the four-tuple information, wherein the four-tuple information has the following structure:

quadruplet = (Src _ IP, src _ port, dst _ IP, dst _ port)

Wherein Src _ IP represents source IP, src _ port represents source port, dst _ IP represents destination IP, and Dst _ port represents destination port

2) If the cache is not empty, judging whether the quadruple information in the newly generated entry information exists in the cache, if not, directly storing the newly generated entry information in the cache, otherwise, comparing the newly generated entry information with the TTL value of the entry information in the corresponding cache, and judging as follows:

(a) If the absolute value of the comparison exceeds the threshold value, the abnormal conversation flow is considered to exist, and subsequent judgment is needed to refine various conditions;

(b) If the absolute value of the comparison does not exceed the threshold, the current session flow is considered to be normal, and the TTL value of the corresponding item information in the cache needs to be updated;

the generation formula of TTL _ Mean is as follows:

TTL_Mean＝(TTL_Mean*(n-1)+TTL)/n

the newly generated TTL value calculation formula is as follows:

wherein the New _ TTL is an integer,

for rounding down, TTL _ Mean is the TTL average value of the data flow, TTL is the newly generated item TTL value, and n is the total number of the current data flow packets;

3) The setting of the threshold requires actual statistical observation by two methods:

(a) The method comprises the following steps Comparing the range of a plurality of data streams, if the range of one stream is very small, the data stream is considered not to be attacked and hijacked; conversely, a hijacking attack may be considered to have been suffered; in the data interaction between the terminal and the external network test server, whether the content is changed before and after is checked by setting the content of a server return packet, and whether hijacking is suffered is judged by observing the change of data flow TTL;

(b) The method comprises the following steps Whether correct content is returned or not, whether malicious advertisements are implanted or not and whether other irrelevant webpages are skipped or not are observed by visiting the website, the change of data stream TTL is observed, whether hijacking is suffered or not is judged, and a proper size is searched to distinguish normal data streams from abnormal data streams in consideration of the current network environment;

(3) Establishing a matching rule corresponding to subsequent judgment under the condition that TTL exceeds a threshold value:

1): TCP protocol Flags bit: the TCP protocol has a plurality of flag bits, different flag bits represent the state of the current TCP session, whether the TCP session is normal or not and the problems are known through the change of the flag bits, and the flag bits are as follows:

f: end of session

P: send immediately

A: acknowledgement bit

R: reset bit

S: synchronization bit

If the field is 1, considering that serious errors occur in the TCP session process, ending the session and reconstructing a new session;

a TCP data packet simultaneously comprises a plurality of information bits;

if the flag information bit is SA, the TCP session is considered to be hijacked in the handshake process;

the Flags information is FPA, the session can be considered to be abnormal preliminarily, and further judgment can be carried out by combining HTTP layer information;

if the Flags information bit is R, it can be considered that an attacker resets the session communication process;

if the Flags information bit is F, it may be preliminarily considered that the session is considered to be abnormal, and may be further determined by combining HTTP layer information;

2): HTTP protocol status code: the state code is the detailed information obtained from the target server, the state of the target server and the operation to be performed next can be known according to different state codes, and the state feedback of the data request and the like are given as main state codes:

200: page request success 30-0-7 } understood to be a page redirect;

if the Flags information bit is FPA and the HTTP status bit is 30 page 0-7, then it is determined that part of the file in the session stream is hijacked and tampered;

if the Flags information bit is F and the HTTP status bit is 200, it is determined that the attacker tampered with the content and the session is ended.

Images