RU2622788C1 - Method for protecting information-computer networks against cyber attacks - Google Patents

Abstract

FIELD: radio engineering, communication.

SUBSTANCE: initial values of the data field T_init for existing message packets transmission routes are set, message packets are then transmitted to all routes between the trusted senders and recievers, and the measured values of reference values of the data field T_et are stored, after devision and storing, from a header of a received packet, values of the data fields are: T, D and I, if the compared reference values of the data fields do not match with the values of data fields of the received packet, a notification packet identifying the existence of an attack is transmitted from the receiver to the sender, in this case, to transmit the next message packet between the said pair of the trusted sender and receiver, a new routeis set, and values of the data fields: T, D and I of the received packet with reference values are re-devided, re-stored and re-compared, in case if the packet values of the data fields match, the abscence of an attack is identified, then massive {A} is formed, and all rotes identified existence of an attack are recorded therein.

EFFECT: increased ICN security against cyber attacks by identifying routes of transmission of message packets with nodes exposed to computer attacks, and, consequently, their re-use exception, and, in case of increased network nodes number, reduced time for the detection of computer attacks.

6 dwg

Description

The invention relates to telecommunications and can be used in systems of protection against computer attacks by their reliable detection and blocking in information computer networks (IHD).

A known method of protection against computer attacks, implemented in RF patent No. 2179738, "A method for detecting remote attacks in a computer network", class G06F 12/14, decl. 04/24/2000

This method includes the following sequence of actions. Monitoring the information flow of message packets addressed to the IHD subscriber, including continuously renewed counting of the number of packets, performed within a series of packets arriving from the communication channel (CS) one after another at intervals of no more than a specified time. At the same time, the incoming data packets are checked for compliance with the given rules each time the size of the next observed series reaches a critical number of packets.

The disadvantages of this method are the narrow scope, due to its purpose mainly to protect against the substitution of one of the participants in the connection, and lack of reliability when detecting other types of computer attacks. In the analogue, a limited set of indicative descriptions of computer attacks is used. At the same time, they do not take into account the presence of a large number of types of computer attacks, in particular types of attacks that use fragmentation of packets transmitted between segments of the coronary heart disease, which creates the conditions for skipping the latter and, as a result, reduces the stability of the coronary heart disease.

There is a method of operational dynamic analysis of the states of a multi-parameter object, described in RF patent 2134897, published on 08.20.1999, which allows detecting computer attacks by changing the state of an IHD element. In the known method, the results of the tolerance assessment of heterogeneous dynamic parameters are converted into corresponding information signals with a generalization over the entire set of parameters in a given time interval and the relative magnitude and nature of the change in the integral state of the multiparameter IHD element is determined.

The disadvantage of this method is the narrow scope, due to the fact that despite the possibility of operational diagnostics of the technical and functional states of the multiparameter element of coronary heart disease, a limited set of attribute space is used in it, which creates the conditions for skipping remote computer attacks (see Medvedovsky I.D. and other attack on the Internet. - M .: DMK, 1999. - 336 pp., ill.) and, as a result, leads to a decrease in the stability of the functioning of coronary heart disease.

A known method of protection against computer attacks, implemented in the device according to the patent of the Russian Federation 2219577, "Information retrieval device", class G06F 17/40, published April 24, 2002. The method consists in the fact that the i-th packet is received from the CS, where i = 1 , 2, 3, ..., and remember it. Receive the (i + 1) th packet, remember it. Identification signs are extracted from the header of the i-th and (i + 1) -th packets, they are analyzed for coincidence, and the decision is made on the fact of a computer attack based on the results of the analysis.

The disadvantage of this method is the relatively low stability of the IVS functioning under the influence of computer attacks, due to the fact that by comparing two message packets - the next and the previous one, only one family of computer attacks is recognized - the “storm” of false requests to establish a connection, while computer attacks of others types with high destructive capabilities are not recognized.

A known method of protecting information and computer networks from computer attacks, implemented in patent RU No. 2285287, IPC G06F 12/14 H06F 12/22, publ. 10/10/2006, bull. No. 28. The method consists in accepting the i-th, where i = 1, 2, 3 ..., the message packet from the communication channel, remembering it, receiving the (i + 1) -th message packet, remembering it, and extracting it from the remembered fragmented message packets the parameters characterizing them calculate the necessary parameters for comparing the received fragmented packets and, based on the results of the comparison, decide on the presence or absence of a computer attack.

The disadvantage of this method is the low efficiency of detecting a computer attack, due to the implementation of the appropriate detection steps already in the process of carrying out a computer attack, which can lead to unauthorized exposure to the computer network.

The closest in technical essence to the proposed method is a method of protecting information and computer networks from computer attacks, implemented in patent RU No. 2472211, IPC G06F 12/14, publ. 01/10/2013, bull. No. 1. The method consists in the following actions: they form an array for storing fragmented message packets and arrays for storing parameters; data fields are used as selected fields from stored message packets: “Packet lifetime” {T}, “Options” {О}, “IP address destination "{D}," IP source address "{I}, additionally form a list of trusted addresses of the recipient and sender of message packets that are stored in arrays of reference parameters of data field values:" IP destination address "{D _floor } and" IP source address »{I _r}, then adapted information-processing network for which a test mode is measured "packet lifetime" and "Options" values of data fields package for all routes between trusted by the recipient and the sender of message packets and storing the measured parameter values in the respective arrays of reference values of the parameters , after remembering the received message packet, the values of the data fields: T, O, D and I are extracted from the header of this packet and the reference values of the data fields “Packet lifetime”, “Options”, “IP address n values ”and“ Source IP address ”with the values of the data fields from the received packet, and establish the fact of no attack if the reference values of the data fields:“ Packet lifetime ”,“ Options ”,“ Destination IP address ”and“ Source IP address ”match with the values of the data fields from the received packet, and the fact of the presence of an attack is established if the reference values do not match the values of the data fields from the received packet.

The disadvantage of the prototype method is the relatively low protection against a computer attack, due to the implementation of appropriate actions to detect a computer attack for message packets transmitted only along one route in the IHD, as well as a significant increase in the time of detection of a computer attack with an increase in the number of IHD nodes.

The objective of the invention is to provide a method of protecting information and computer networks from computer attacks, providing an extension of the functionality of the prototype method to increase security against computer attacks by determining the transmission routes of message packets that have nodes that are susceptible to computer attacks, and, accordingly, eliminating repeated the use of these routes, as well as with an increase in the number of nodes in the communication network, a decrease in the time for detecting a computer attack.

The objective of the invention is solved in that a method of protecting information and computer networks from computer attacks, which consists in forming an array for storing fragmented message packets and arrays for storing parameters extracted from stored message packets, forming a list of trusted addresses of the recipient and sender of message packets, which store in the arrays of reference parameters the values of the data fields: "IP destination address" {D _et } and "IP source address" {I _et }, receive the next message packet from the channel all communications, remember it, to detect the fact of an attack or its absence, extract the values of the data fields from the header of this packet: “Packet lifetime” T, “IP destination address” D and “IP source address” I, and store them in the corresponding arrays { T}, {D} and {I}, compare the reference values of the data fields "packet lifetime", "IP destination address" and "IP source address" with the values of the data fields from the received packet, and in the absence of a computer attack send another message packet , in the computer network, characterized in which additionally sets the initial values of the “Packet Lifetime” data field for the existing message packet transmission routes, which are stored in the {T _ref } array generated by the sender of the message packets for them, and written to the corresponding data field, then message packets are transmitted along all routes between the trusted recipients and senders of information and computer networks in test mode, measure the values of the data fields of the packet "lifetime of the packet" at the recipient, and store the measured values of the parameter in sf rmirovanny array of reference parameter values of the field data "packet lifetime» T _fl, whereupon the transmission of message packets between trusted senders and receivers in the "packet lifetime" packet data field is recorded corresponding initial values of the array {T _ref}, then after isolation and storing from the header of the received packet the values of the data fields: “Packet lifetime” T, “IP destination address” D and “IP source address” I in the corresponding arrays {T}, {D} and {I}, if the reference field values are compared data "Time w know the packet ”,“ IP destination address ”and“ IP source address ”did not match the values of the data fields from the received packet; they transmit from the recipient to the sender a notification packet when an attack is established, in this case, to send another packet of messages between this pair of trusted the sender and receiver set a new route, and from the array {T _ref } write the initial values of the packet lifetime data field for this route into the corresponding packet header field, after which the next message packet is transmitted between by the faithful sender and recipient in accordance with this route, and re-select, store, and compare the values of the data fields: "Packet lifetime" T, "IP destination address" D and "IP source address" I received packet with reference values, in the case coincidence of the values of the data fields of the packet establishes the fact of the absence of an attack, after which they form an array {A}, and record all the routes for which the fact of the presence of an attack is established in it.

The aforementioned new set of essential features provides the opportunity to increase security against a computer attack by defining the transmission routes of message packets that contain nodes susceptible to a computer attack and reducing the time it takes to detect a computer attack while increasing the number of nodes in the ITT.

The analysis made it possible to establish that there are no analogues that are identical to the features of the claimed method, which indicates the compliance of the claimed method with the condition of patentability “novelty”.

Search results for known solutions in this and related fields of technology in order to identify features that match the distinctive features of the claimed object from the prototype showed that they do not follow explicitly from the prior art. The prior art also did not reveal the popularity of the impact provided by the essential features of the claimed invention, the transformations on the achievement of the specified technical result. Therefore, the claimed invention meets the condition of patentability "inventive step".

The "industrial applicability" of the method is due to the presence of an element base, on the basis of which devices can be made that implement this method with the achievement of the destination specified in the invention.

The claimed method is illustrated by drawings, which show:

FIG. 1 is a flowchart of a method for protecting an ITT from computer attacks;

FIG. 2 is a diagram explaining a procedure for forming transmission routes of message packets in an IVS;

FIG. 3-diagram explaining the implementation of computer attacks and changing the routes for transmitting message packets to the IVS;

FIG. 4 - IP datagram header;

FIG. 5 is a table of reference values of the data fields “IP Destination Address”, “IP Source Address” and “Packet Lifetime” for specific routes;

FIG. 6 - dependence of the time of detection of a computer attack on the number of nodes in the communication network.

The implementation of the claimed method is illustrated by the algorithm (Fig. 1), circuits (Fig. 2 and Fig. 3) and is explained as follows:

At the initial stage, the arrays P, D, I, T, D _et , I _et , T _ref , T _{et are formed} for storing the parameters specified and extracted from the stored message packets, respectively (block 1, Fig. 1):

P - to memorize incoming IP packets from the communication channel;

D - for storing the values of the data field "IP destination address";

I - for storing the values of the data field "IP source address";

T - to remember the values of the data field "lifetime of the packet";

D _et - for storing the reference parameters of the values of the data field "IP destination address";

I _floor - for storing the reference parameters of the values of the data field "IP source address";

T _ref - to memorize the initial parameters of the values of the data field "Package lifetime";

T _et - to memorize the reference parameters of the values of the data field "Package lifetime".

In the present invention use the functions of the IP Protocol used in the transmission of packets over the network. The IP header contains many fields (FIG. 4). In the fields “IP Destination Address” and “IP Source Address” there will be 32 bit sequences defining the logical addresses of the destination and source of the message packet necessary for transmitting it via the IVS. The “packet lifetime” field defines the maximum lifetime of a datagram on the network [RFC 791, Internet Protocol, 1981, September, pp. 14-22].

Trusted IP addresses of the receiver and sender are determined to store these values in an array of D _et , I _et (block 2, Fig. 1). Trusted IP addresses mean pairs of addresses, source and destination, legitimate subscribers of various fragments of the IVS. The values of trusted addresses of the recipient and sender of message packets in the corresponding arrays are stored.

Also entered and stored initial value T _ref field parameter data "packet lifetime" for all packet transfer routes messages (block 3, fig. 1). In this case, these values are set taking into account the number of communication network nodes on the transmission route.

Thus, a sequence of nodes lying on the path from the sender to the recipient form a message transmission route [V.G. Olifer, N.A. Olifer Computer networks. Principles, technologies, protocols (3rd edition) St. Petersburg: Peter - 2006, p. 64].

This is due to the fact that the value of the "packet lifetime" field is necessary to implement the mechanism of erasing packets for which the value of this field is zero [RFC 791, Internet Protocol, 1981, September, pp. 14-22]. To ensure guaranteed delivery of packets to the recipient, the value of this field must exceed the number of intermediate nodes on the transmission route. In the general case, the initial value T _{out of the} parameter of the “Packet Lifetime” data field parameter can be selected one for all routes, but it must correspond to the longest route with a larger number of nodes. For example, in FIG. 2 shows five possible routes for packet transmission over a communication network between a sender and a receiver. So the first route, consisting of intermediate nodes with addresses: 100.0.0.1; 101.0.0.1; 109.0.0.1; 115.0.0.2 A sufficient value for the packet lifetime data field is five. And for the fifth route, consisting of intermediate nodes with addresses: 100.0.0.1; 103.0.0.1; 104.0.0.2; 108.0.0.1; 114.0.0.2; 120.0.0.2; 119.0.0.1; 118.0.0.2 already sufficient value of the data field "Packet lifetime" is nine. Considering that the fifth route has the maximum number of intermediate nodes, then T _ref can be selected equal to ten for all routes, as shown in FIG. 5.

Then, the IVS is transferred to the test mode of operation, which implies its adaptation to real conditions (block 4, Fig. 1). Under adaptation in accordance with [GOST R 53622-2009 “Information technology. Information computing systems. Stages and stages of the life cycle, types and completeness of documents ”, p. 4-5] we understand the operation of the information and computer network in test mode for its implementation in specific operating conditions. Moreover, in test mode, ideal conditions for the functioning of the communication network are assumed, i.e. the absence of computer attacks, which allows to obtain reference values of the necessary characteristics of the transmitted message packets. In this mode, message packets are transmitted between all pairs from the sender I ^k _j to the recipient D ^k _j , j = 1, 2, ... N, where N is the number of pairs of addresses of trusted subscribers, along all available routes k = 1, 2, ... M, where M is the number of routes between the jth pair of addresses of trusted subscribers (block 5, Fig. 1).

Next, the recipient measures the real values of the data field of the packet "Lifetime of the packet" T ^k _j for all available routes k = 1, 2, ... M for all existing pairs of addresses of trusted subscribers j = 1, 2, ... N (blocks 6-11, Fig. 1).

When packets are transmitted over a network, intermediate nodes (routers) route them using the address information in the packet header [GOST R ISO / IEC 7498-1-99 “Information technology. Interconnection of open systems. The basic reference model. Part 1. The basic model ”, p. 13].

Thus, the obtained values of the data field of the packet "Lifetime of the packet" T ^k _j show the number of intermediate nodes through which the message packet was transmitted along the k-th route between the j-th sender-receiver pair. For example, for the message packet paths shown in FIG. 2 shows the measured values of the data field of the packet “Lifetime of the packet” T ^k _j in the table of FIG. 5, which are the reference ones (since they were obtained in the test mode of operation) for the corresponding routes and will be written to the array {T _et } (block 7, Fig. 1). So, for the first route, taking into account the sender's initial value for the parameter of the “packet lifetime” data field parameter T _ex = 10, at each intermediate node (router) through which the message packet is transmitted (nodes: 100.0.0.1; 101.0.0.1; 109.0 .0.1; 115.0.0.2) the value of the data field "packet lifetime" is reduced by one [V.G. Olifer, N.A. Olifer Computer networks. Principles, technologies, protocols (3rd edition) St. Petersburg: Peter - 2006., p. 600] and the reference value of the data field "packet lifetime" of the received packet from the recipient will be equal to T _et = 10-4 = 6. Similarly, for routes 2-5 shown in FIG. 2 in the table of FIG. Figure 5 shows the corresponding reference values of the packet lifetime data field: route 2 has five intermediate nodes (nodes: 100.0.0.1; 102.0.0.1; 105.0.0.2; 110.0.0.1; 115.0.0.2) and reference values T _et = 10- 5 = 5; route 3 has six intermediate nodes (nodes: 100.0.0.1; 103.0.0.1; 107.0.0.2; 106.0.0.2; 110.0.0.1; 115.0.0.2) and reference values T _et = 10-6 = 4; route 4 has seven intermediate nodes (nodes: 100.0.0.1; 103.0.0.1; 107.0.0.2; 113.0.0.2; 112.0.0.2; 111.0.0.1; 117.0.0.1) and reference values T _et = 10-7 = 3; route 5 has eight intermediate nodes (nodes: 100.0.0.1; 103.0.0.1; 104.0.0.2; 108.0.0.1; 114.0.0.2; 120.0.0.2; 119.0.0.1; 118.0.0.2) and reference values T _et = 10-8 = 2.

After all the reference values of the checked parameters are collected and recorded in the corresponding arrays, the IVS is transferred to the real mode of operation (operation) (block 12, Fig. 1). At the same time, the attackers will carry out various influences on the ITT, including by implementing computer attacks.

Further, during the operation of the IVS, the receiver receives the i-th message packet from the communication channel, stores it in the array P for further work with the header of the i-th packet (blocks 13, 14, Fig. 1).

After that, the values of the data field “packet lifetime” T _i , the data field “IP destination address” D _i and the data field “IP source address” I _i are extracted from the header of the i-th packet and stored in the arrays {T}, {D }, {I}.

Then, the stored values D _i , I _{i of the} received message packet are compared with the reference values from the {D _floor }, {I _floor } arrays, the sender-receiver pair is determined (specific jth pair of trusted subscribers) and the corresponding transmission route of this message packet is determined when comparing the stored value of T _i with the reference values from the array {T _et } for a given sender-receiver pair (block 16, Fig. 1). Moreover, if a computer attack affects the nodes 101.0.0.1 and 102.0.0.1 (Fig. 3), then the first and second routes (Fig. 5) will be unavailable for sending message packets, because these nodes are included in the corresponding routes (node 101.0.0.1 in the first route, node 102.0.0.1 in the second route). In this case, the node 100.0.0.1 operating as a router has several (for the given example, five) alternative routes in the routing table [V.G. Olifer, N.A. Olifer Computer networks. Principles, technologies, protocols (3rd edition) St. Petersburg: Peter - 2006, p. 198]. A specific route is selected from them according to a given criterion, for example, a delay in passing a route by a packet [V.G. Olifer, N.A. Olifer Computer networks. Principles, technologies, protocols (3rd edition) St. Petersburg: Peter - 2006, p. 602-613], i.e. the number of intermediate nodes on the route. Thus, the router will choose a third route that, according to this criterion, has superiority over the others (fewer intermediate nodes), which is alternative to the first and second routes.

In case of non-fulfillment of the condition (block 16, Fig. 1), a packet is sent from the recipient D _j to the sender I _i notifying of the “establishment of the fact of a computer attack” (block 17, Fig. 1) and the sender sets the next packet transmission route k = k +1 for this sender-receiver pair (for the given example, the third route is selected from the table in Fig. 5), and for it, the corresponding initial value from the array {T _ref } is selected and recorded in the data field "Packet lifetime" (block 19, fig. . one).

Then, the next message packet (block 20, Fig. 1) is transmitted from the sender to the recipient along the selected route, and for this packet, actions are repeated from the reception of the message packet from the communication channel (block 13, Fig. 1).

If the conditions (block 16, Fig. 1) are fulfilled, then a conclusion is made that there is no fact of a computer attack and this i-th message packet is transmitted to the information-computer network (block 21, Fig. 1).

After that, an array {A} is formed, and all routes are recorded in it for which the fact of the presence of an attack has been established (block 22, Fig. 1), which eliminates their reuse for transmitting message packets.

The feasibility of implementing the formulated technical result was verified by machine simulation. Using modeling, the relationship between the recognition time t _obn (detection) of a computer attack and the number of nodes in the communication network N is obtained (Fig. 6).

The achievement of the technical result is illustrated as follows. For the prototype method, when a computer attack is detected, the values of the “Packet lifetime” and “Options” data fields are compared for the time T ₁ , which mainly depends on the values of the “Options” field, because it contains the packet transmission route — these are 3-15 nodes in the route [V.G. Olifer, N.A. Olifer Computer networks. Principles, technologies, protocols (3rd edition) of St. Petersburg - 2009, pp. 608-611], and it consists of the addresses of intermediate nodes - these are 4 bytes in decimal form 12 bits [V.G. Olifer, N.A. Olifer Computer networks. Principles, technologies, protocols (3rd edition) St. Petersburg - 2009, pp. 567-571]. For the proposed method, the detection of a computer attack is carried out according to the results of the analysis of the values of the “Packet lifetime” data field of the received packet during T ₂ , which depend only on the number of nodes in the transmission route — this is a 2-3 bit number in decimal form.

In this case, the difference in the required time for detecting a computer attack ΔT = T ₁ -T ₂ the greater the greater the number of nodes in the communication network, which is achieved by the formulated technical result when implementing the claimed method, i.e. reducing the time to detect a computer attack.

In addition, increasing the protection against computer attacks for the given example is achieved by the fact that out of the five available routes for transmitting message packets, two have nodes susceptible to computer attacks and the proposed method eliminates the retransmission of message packets. In this case, the security of the ITT from computer attacks is increased by 25%, which confirms the formulated technical result.

Thus, the claimed method, by determining the transmission routes of message packets that have nodes susceptible to computer attacks and, accordingly, eliminating the reuse of these routes, can increase the security of the IVS from computer attacks, and also reduce the time it takes to detect them when the number of communication network nodes increases.

Claims (1)

A method of protecting information and computer networks from computer attacks, which consists in forming an array for storing fragmented message packets and arrays for storing parameters extracted from stored message packets, forming a list of trusted addresses of the recipient and sender of message packets that are stored in arrays of reference parameters data field values: «IP destination address» {D _fl} and «IP source address» {I} _fl, taking another message packet from the communication channel, it is stored, to discover The fact of an attack or its absence extracts from the header of this packet the values of the data fields: “Packet lifetime” T, “Destination IP address” D and “Source IP address” I, and store them in the corresponding arrays {T}, {D} and {I}, compare the reference values of the data fields "packet lifetime", "destination IP address" and "source IP address" with the values of the data fields from the received packet, and in the absence of a computer attack send another message packet to the computer network, characterized in that the initial values are additionally set the data field "Lifetime of the packet" for the existing routes of transmission of message packets, which are stored in the array {T _ex } for the message packet sender and write them to the corresponding data field, then message packets are transmitted along all routes between trusted recipients and senders information and computer networks in test mode, measure the values of the data fields of the packet "lifetime of the packet" at the recipient and store the measured parameter values in the generated array of reference parameters values of the data field “packet lifetime” T _et , after which, when transmitting message packets between trusted senders and recipients, the corresponding initial values from the array {T _ref } are recorded in the data field of the packet “packet lifetime”, then after selection and storage from the received header packet values of the data fields: “Packet lifetime” T, “Destination IP address” D and “source IP address” I in the corresponding arrays {T}, {D} and {I}, if when comparing the reference values of the data fields “Lifetime” packet "," destination IP address "and" IP address “source” did not coincide with the values of the data fields from the received packet, they transmit from the recipient to the sender a notification packet about the fact of an attack, in this case, a new route is set for the transmission of the next packet of messages between this pair of trusted senders and receivers, and from the array _ref } write the initial values of the “packet lifetime” data field for a given route to the corresponding packet header field, after which they transfer the next message packet between the trusted sender and recipient in correspondence with this route, and re-select, remember and compare the values of the data fields: "Packet lifetime" T, "Destination IP address" D and "Source IP address" I of the received packet with the reference values, if the values of the packet data fields coincide, set the fact that there is no attack, after which an array {A} is formed and all routes for which the fact of the presence of an attack are established are written into it.

Images