FR2977432A1 - METHOD FOR DETECTING AND PREVENTING INTRUSIONS IN A COMPUTER NETWORK, AND CORRESPONDING SYSTEM - Google Patents

Abstract

The invention relates to a system and a method for detecting and preventing intrusions into a computer network 1, for preventing intrusions by detecting and blocking them before penetration of the network. The system comprises a firewall 2 capable of analyzing data packets D flowing over a connection, via an analysis engine 3 capable of detecting the presence of malicious data. The firewall is capable of correcting and / or deleting the malicious data detected before transmitting the data packets D on the network 1. The firewall 2 is able to operate in a first mode in which it allows the packets of data D on the connection to the network 1, and in a second mode in which the connection is temporarily blocked. As long as the analysis engine 3 does not detect any malicious data in a data packet D, the firewall 2 operates in the first mode. When the analysis engine 2 detects the presence of one or more malicious data in a data packet D, the firewall 2 goes into the second mode, corrects and / or deletes the malicious data from the data packet D, resynchronizes the connection then unblocks the connection for a return to the first operating mode.

Description

METHOD FOR DETECTING AND PREVENTING INTRUSIONS IN A COMPUTER NETWORK, AND CORRESPONDING SYSTEM.

The present invention relates to a system and method for detecting and preventing intrusions in a computer network, for preventing intrusions by detecting and blocking them before penetration of the network. In a computer network, the availability of data and its transmission in a context of maximum security is a constant problem. The growing complexity of attacks requires increasingly sophisticated and intelligent network protection. It must indeed be possible in particular to check the contents of data packets that transit, and react to an attack before it has penetrated the network that we seek to protect. Protection solutions are known, such as the solution shown diagrammatically in FIG. 1, which consist in the use of a relay device 2, for example a proxy or proxy comprising a firewall 2 which analyzes the data packets D traveling on a connection 4 to detect the presence of malicious data and correct or delete the data before the transmission of data packets D on the network 1. To do this, the proxy captures the connection 4, for example using an address translation performed by the firewall 2. This address translation is intended to replace the destination address of the data packets D by that of the firewall 2, so that the data packets D are all intercepted and redirected to the firewall 2. The firewall 2 can then read the contents of the data D, for example through a mechanism of the type "sockets", and respond as a conventional server. Once the firewall 2 has analyzed and possibly cleaned the data D, it must create a new connection 5 to the original recipient of the data. For the traffic to be carried out end-to-end, the new connection 5 must be created at the time of the capture of the original connection 4, and the firewall 2 must pass the data D 'therein in both directions. transparent way. In this solution, it is therefore question of a relay device which, to suppress the attacks, modifies the original connection 4 by intercepting it, as represented by the dashed cross in FIG. 1. This relay device creates a new connection 5 to regenerate data packets D 'to be transmitted to the destination.

Such a regeneration is very expensive in terms of performance and resources, because all the data of the connection must be modified, which implies many read / write of data on the original connection and on the new connection created. Solutions are also known in which the relay device is content to analyze the data packets, and, when malicious data is detected, either to send an alert or to block the data packet until intervention is made. an administrator. In both cases there is the problem of cleaning the data, the data being either transmitted uncleaned or blocked before manual cleaning. In the first case, performance is improved because there is no connection capture or temporary blocking of traffic. But the data is not cleaned and the mere sending of an alert is insufficient to foil an attack, once the malicious data is transmitted over the network. In the second case, the data blocking significantly disrupts the performance, and the data cleansing remains arbitrary. It is therefore the object of the invention to provide a reliable solution that makes it possible to solve the aforementioned problems among other problems, in particular concerning the efficient protection of a network without loss of performance. To this end, the invention relates, in a first aspect, to a method for detecting and preventing intrusions in a computer network comprising a firewall. The method includes analyzing data packets 30 traveling on a connection, via a firewall analysis engine capable of detecting the presence of malicious data, the firewall being able to correct and / or or delete previously detected malicious data before transmitting the data packets over the network. In addition, the firewall the firewall is adapted to operate in a first mode in which it allows the flow of data packets on the connection to the network, and in a second mode in which the connection is temporarily blocked. As long as the scan engine does not detect any malicious data in a data packet, the firewall works in the first mode. When the scanning engine detects the presence of one or more malicious data in a data packet, the firewall goes into the second mode, corrects and / or removes the malicious data from the data packet, resynchronizes the connection and then unblocks the connection for a return to the first mode of operation. In an implementation variant, it is the analysis engine which, in the second mode of operation, performs the correction and / or deletion of the malicious data of the data packet, the resynchronization of the connection and the unblocking of the data. connection for a firewall return in the first mode of operation. In another variant of implementation, possibly in combination with the previous one, in the second mode of operation, the new data packets flowing over the connection are put on hold until the connection is unblocked. In yet another implementation variant, possibly in combination with one or more of the preceding embodiments, the resynchronization of the connection notably consists in applying a correction factor to an acknowledgment value and in sending back to the sender of the data packet. corrected acknowledgment value. This correction factor is a function of the difference between the size of the malicious data before and after the modification and / or deletion of this malicious data.

According to a second aspect, the invention relates to a system for detecting and preventing intrusions in a computer network comprising a firewall.

The firewall includes an analysis engine capable of analyzing data packets flowing over a connection and detecting the presence of malicious data. This firewall is able to correct and / or delete previously detected malicious data before transmitting the data packets on the network. In addition, the firewall is adapted to operate in a first mode in which it allows the data packets to flow over the connection to the network, and in a second mode, triggered by the detection of malicious data by the engine of the network. analysis, in which second mode the connection is temporarily blocked. On the other hand, in the second mode, the firewall is able to correct and / or delete the malicious data of the data packet, to resynchronize the connection and then to unblock the connection in order to return to the first mode of operation. In a first variant embodiment, the analysis engine is capable, in the second mode of operation, of implementing the correction and / or deletion of the malicious data of the data packet, the resynchronization of the connection and the unblocking of the data. connection for firewall return in the first mode of operation. In another variant embodiment, possibly in combination with the previous one, the firewall is able, in the second mode of operation, to put on hold the new data packets circulating on the connection. In yet another variant embodiment, possibly in combination with one or more of the preceding embodiments, the firewall, possibly via the analysis engine, is able, for the resynchronization of the connection, to apply a factor of correction to an acknowledgment value and return the corrected acknowledgment value to the sender of the data packet. This correction factor is a function of the difference between the size of the malicious data before and after the modification and / or deletion of this malicious data.

Other features and advantages of the invention will appear more clearly and completely on reading the following description of the preferred variants of implementation of the method and system realization, which are given as non-exemplary examples. and with reference to the following appended drawings: FIG. 1 shows schematically a protection system and its operation in the state of the art; FIG. 2 schematically represents an example of a protection system and its operation according to the invention; FIG. 3 schematically represents an exemplary implementation of the method according to the invention. Regarding Figure 1, it actually corresponds to the state of the art and has been described above. FIG. 2 diagrammatically shows the protection system according to the invention, which notably comprises a firewall 2. It can of course also include other computing devices, such as storage devices, calculation devices, memory devices input-output, not shown in Figure 2. The firewall 2 is placed at an entry point of the computer network 1 to protect, and includes an analysis engine 3 which allows in particular to analyze the data packets D traveling on a network input connection 1. Each data packet D is received and analyzed by the analysis engine 3 on the original connection, to detect the presence of any malicious data that will be appropriately processed by the firewall 2.

Preferably, the processing of data packets D in case of detection of malicious data is performed by the analysis engine 3 itself. But it can also be achieved by a processing module separate from the analysis engine 3. As is shown in more detail in FIG. 3, on an example of implementation of the method of the invention, the firewall 2 is able to operate in two operating modes respectively A and B. In the first operating mode A, the firewall 2 allows the data packets D to flow over the connection to the network 1, from their sender EXP out of the network. 1 to their destination DEST on the network 1. The firewall 2 operates in this first mode A, as long as the analysis engine 3 does not detect any malicious data in the data packets D. In the example shown in FIG. FIG. 3, the data packet D contains the data DATA, sent by EXP to the destination DEST. According to the communication protocol between EXP and DEST, data DATA is associated with a sequence number Seq, an acknowledgment value Acq and a value Sz representing the size of the data DATA, ie 4 in this example. The analysis engine 3 detects no malicious data in the data DATA, so that the data packet D is transmitted to EXP on the original connection. According to the communication protocol, the recipient DEST of the data packet D then returns to the sender EXP an acknowledgment, indicating via the acknowledgment value Acq equal to 4 that it has received a datum of size 4. Since this is an acknowledgment step, without data transmission, the size value Sz is 0. The next transmission sequence of a new data packet D carries an equal sequence number Seq at 4, corresponding to the previous Seq sequence number incremented by the size Sz of the data transmitted to the previous sequence and which has been correctly acknowledged. The acknowledgment value Acq is at 0 because no data has yet passed from DEST to EXP in this new sequence. The value of size Sz is this time equal to 10 since the data D transmitted is equal to ATTACKDATA (10 characters corresponding to 10 bytes of data). This new data packet D is analyzed by the analysis engine 3 which detects in this packet the presence of the malicious data dm equal to ATTACK. The firewall then immediately goes into the second operating mode B, in which the connection is temporarily blocked.

In this second operating mode B, the new data packets arriving on the connection can simply be ignored. However, it is preferable not to lose data, so that it is preferable to put the new data packets on hold in a buffer provided for this purpose. During this time of temporary blocking of the connection, the firewall 2 will correct and / or delete the malicious data or dm detected by the analysis engine 3, resynchronize the connection. When the connection is resynchronized, the connection can effectively be unblocked by the firewall 2, which corresponds to a return of the firewall 2 in the first mode of operation A. All or part of these connection blocking processes , correction and / or deletion of the malicious data dm, resynchronization of the connection and unblocking of the connection, may possibly be carried out directly by the analysis engine 3, as shown in FIG. 3. In this example represented in FIG. 3, the analysis engine 3 having received from EXP the data packet D corresponding to ATTACKDATA and having detected the presence of the malicious data dm in this data packet D, performs the deletion of dm, so that it does not transmit at DEST that the datum D equal to DATA, that is to say a data D cleaned. To this datum D equal to DATA, transmitted to DEST, are associated the sequence number Seq equal to 4, the acknowledgment value Acq equal to 0, and the value of size Sz which is equal to 4. It can therefore be seen that the correction of the data packet D induces desynchronization in the sequences, so that if no processing is performed, the recipient B will not be able to acknowledge as EXP expects, and the acknowledgment mechanism according to the protocol of communication is disrupted. For this reason, the destination DEST of the data packet D will send back to the sender EXP an acknowledgment, indicating by means of the acknowledgment value Acq equal to 8 that it has received a data item of size 8. (corresponding to the cumulative size of the previous data and the size of the new data). As for the previous sequence, since this is an acknowledgment step, without data transmission, the size value Sz is 0. However, the sender EXP expects an acknowledgment on the basis of an Acq value equal to 14 corresponding to the accumulation of the size of the previous data packet already acknowledged (DATA) and the size of the data packet being processed (ATTACKDATA). Also, the analysis engine 3 applies a correction factor fc equal to 6, the cumulative increase from 8 to 14.

This correction factor fc effectively corresponds to the difference between the size of the data D before correction and the size of this data D after correction, ie 6 (for 10 minus 4) in the example shown in FIG. it can be said that this correction factor fc effectively corresponds to the difference between the size of the malicious data dm before correction and the size of this malicious datum dm after correction, ie 6 (for 6 minus 0) in the example shown in FIG. Figure 3 wherein the correction is a deletion. In this example, it has been schematically considered that the data packet D equal to ATTACKDATA contained a malicious part dm equal to ATTACK and a healthy part DATA, and we therefore carried out a deletion of this malicious data dm. The reasoning is equivalent if one considers that the packet of data D equal to ATTACKDATA constitutes itself the malicious data, in which case one modifies this malicious data to make it healthy.

In both cases, the correction factor fc mentioned above is equal to 6. Thus, the analysis engine 3 can return to the sender EXP the acknowledgment value 14 that it expects. The connection is then resynchronized, and the firewall can unblock this connection for a return to the first operating mode A in which the next data packet will be scanned. If the data packets have been put on hold during the temporary blocking of the connection, as explained above, the first data packet arrived during the blocking is transmitted and analyzed by the analysis engine 3. If, on the other hand, no data packet queuing mechanism is provided, it is the first data packet arriving after the unblocking of the connection is transmitted and analyzed by the analysis engine 3, the previous packets then being lost. The whole of the description above is given by way of example and is not therefore limiting of the invention.

In particular, the invention is not limited to resynchronizing the temporarily blocked connection by applying a correction factor in the acknowledgment mechanism. More generally, this resynchronization is a function of the communication protocol and consists in making the correction of the malicious data transparent to the sender by making him believe that the data packet concerned has been fully transmitted to the recipient.

Claims (8)

REVENDICATIONS1. A method for detecting and preventing intrusions into a computer network (1) having a firewall (2), including analyzing data packets (D) flowing over a connection, via an engine d analysis (3) of the firewall (2), said analysis engine (3) being able to detect the presence of malicious data (dm), and said firewall (2) being able to correct and / or delete the malicious data (dm) previously detected before transmitting the data packets (D) on said network (1), characterized in that said firewall (2) being able to operate in a first mode (A) in which it allows said data packets (D) to flow on said connection to the network (1), and in a second mode (B) in which said connection is temporarily blocked, - as long as the analysis engine (3) does not detect any malicious data (dm) in a data packet (D), the firewall (2) works in the first mo of (A), - and when said analysis engine (2) detects the presence of one or more malicious data (dm) in a data packet (D), the firewall (2) goes into the second mode (B), corrects and / or deletes the malicious data (dm) of the data packet (D), resynchronizes the connection and then unblocks the connection for a return to the first operating mode (A). 2. Method according to claim 1, characterized in that, in the second operating mode (B), the correction and / or deletion of the malicious data (dm) of the data packet (D), the resynchronization of the connection and the unblocking the connection for a return of the firewall (2) in the first operating mode (A), are performed by the analysis engine (3). 3. Method according to any one of claims 1 and 2, characterized in that in the second operating mode (B), the new data packets flowing on the connection are put on hold, until aublockage of said connection. 4. Method according to any one of claims 1 to 3, characterized in that the resynchronization of the connection comprises in particular to apply a correction factor (fc) to an acknowledgment value (Acq) and to send back to the sender of the data packet (D) said corrected acknowledgment value (Acq), said correction factor (fc) being a function of the difference between the size of the malicious data (dm) before and after the modification and / or deletion of this malicious data (dm). 5. System for detecting and preventing intrusions in a computer network (1) comprising a firewall (2) comprising an analysis engine (3) capable of analyzing data packets (D) circulating over a connection and detecting the presence of malicious data (dm), said firewall (2) being able to correct and / or delete the malicious data (dm) previously detected before transmitting the data packets (D) on said network (1) characterized in that said firewall (2) is operable in a first mode (A) in which it allows said data packets (D) to flow on said connection to the network (1), and in a second mode (B), triggered by the detection of malicious data (dm) by said analysis engine (3), wherein said second mode (B) said connection is temporarily blocked, and in that second mode (B), said firewall (2) is able to correct and / or delete the malicious data (dm) of the paq uet of data, to resynchronize the connection and then to unblock the connection so as to return to the first operating mode (A). 6. System according to claim 5, characterized in that, in the second mode of operation (B), the analysis engine (3) is able to implement the correction and / or deletion of the malicious data (dm) of the data packet (D), the resynchronization of the connection and the unblocking of the connection for a return of the firewall (2) in the first operating mode (A). 7. System according to any one of claims 5 and 6, characterized in that, in the second operating mode (B), the firewall (2) is able to put on hold new data packets flowing on the connection . 8. System according to any one of claims 5 to 7, characterized in that the firewall (2), possibly via the analysis engine (3), is adapted, for the resynchronization of the connection, applying a correction factor (fc) to an acknowledgment value (Acq) and returning to the sender of the data packet (D) said corrected acknowledgment value (Acq), said correction factor (fc) being depending on the difference between the size of the malicious data (dm) before and after the modification and / or deletion of this malicious data (dm).