RU2812087C1 - System and method for analysing incoming traffic flow - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: traffic flow analysis system contains a block for receiving and preliminary analysis of network traffic, a block for identifying new devices, a device for deep inspection of DPI packets, a signature block and a memory block, wherein the receiving and preliminary analysis block is connected to the device for deep inspection of DPI packets and is configured to perform preliminary analysis of incoming traffic flow, and if the traffic belongs to an already established connection, then the packet can be passed without filtering.

EFFECT: expanding the arsenal of technical means and systems for ensuring information security of a computer network.

10 cl, 3 dwg

Description

TECHNICAL FIELD

The invention relates to computer technology and the field of information security through preliminary analysis of the incoming traffic flow to determine whether the traffic belongs to a previously established connection.

BACKGROUND OF THE ART

From the state of the art, means of protecting the perimeter of a local (corporate) computer network are known, referred to as a firewall, firewall, firewall, firewall - complexes of hardware or software that monitor and filter network packets passing through it in accordance with specified rules

An analogue of the proposed solution is the “System for protecting computer networks from unauthorized access”, disclosed in patent RU2607997, IPC G06F 15/163, published on January 11, 2017, while the system for protecting computer networks from unauthorized access is a firewall filter connected between two computer networks such such that all exchange of information between said networks is limited by filtering rules, wherein the firewall contains at least two network interfaces for exchanging data between clients of the first computer network and the second computer network of the two above computer networks, wherein it further comprises a node traffic processing, including a control device that provides input of traffic filtering rules and storage of information about filtering rules, a traffic analysis device that ensures compliance of incoming information with filtering rules, as well as a switching device through which the specified network interfaces are connected to each other and which ensures the passage of information allowed by the rules filtering information between network interfaces and blocking information not permitted by filtering rules, while the filtering rules prohibit the transit transmission of any packets between the specified network interfaces except those that have allowed signs and addressing parameters in their headers, the form of the information part of the packet corresponding to the template stored in memory firewall, as well as request or response parameters corresponding to the set of allowed values stored in the firewall memory.

The “Computer network with a firewall and firewall” is known, disclosed in the patent RU2214623, IPC G06F 15/163, G06F 15/173, published on October 20, 2003, which relates to the field of information security and, in particular, concerns hardware and software components firewalls used to prevent unauthorized access and exchange of information between different subscribers of computer networks. The technical result is to increase information security by not using or completely hiding the network interfaces of the security device. A firewall for local area networks contains at least two network interfaces for packet switching of data between segments of a computer network, performed in accordance with a packet filtering program. After processing the packet in accordance with the filtering rules, the firewall retains without changes the information about the physical and logical addresses of the sender of each packet contained in their headers. The management program does not assign logical addresses to network interfaces and does not transmit information about their physical addresses to the network segments associated with them. To allow changes to filtering rules, the firewall contains a special management interface, and any changes to filtering parameters can only be made through the management interface.

The main disadvantages of the known analogues are that to protect network nodes from penetration through vulnerabilities or to protect against users downloading malicious programs, including viruses, as well as to protect against internal threats and data leakage, the analogues do not provide for the use of a method for monitoring installed connections and analysis of the incoming traffic flow to determine whether it belongs to a previously established connection.

DISCLOSURE OF INVENTION

The technical result of the invention is to expand the arsenal of technical means and systems for ensuring information security of a computer network through the use of an effective system for analyzing traffic flow about whether the traffic belongs to a previously established connection.

The specified technical result is achieved by a system for analyzing traffic flow o the belonging of traffic to a previously established connection, parsing packets to obtain data from packets at the link, network, transport and application levels, dividing the received data from packets into clusters, making decisions on each packet in clusters based on established rules for processing network packets, identifying deviations of network traffic that corresponds to processing rules from the usual packet traffic profile, clarifying established rules for processing network packets.

In a preferred embodiment, the traffic flow analysis system contains a block for receiving and preliminary analysis of network traffic, a block for identifying new devices, a deep packet inspection (DPI) device, a signature block, and a memory block, while the receiving and preliminary analysis block connected to a deep packet inspection (DPI) device and capable of preliminary analysis of the incoming traffic flow. If the deep packet inspection (DPI) device determines that the traffic belongs to an already established connection, that is, such packets with the Synchronize sequence numbers (SYN) and acknowledgment field is significant (ACK) flags have already passed through the control unit, then the packet can be passed without filtering.

In one embodiment, the system includes a graphical user interface to which the results of the work are sent for review by the system administrator.

If the packet belongs to a new connection, it is sent to the DPI device for packet parsing. The DPI device parses Internet protocol (IP) specification packets to obtain data at the data link, network, transport, and application layers.

In one embodiment, the DPI device is capable of retrieving known application protocols in use, tunneled IP addresses, user names, file names, HTTP links and request URLs, and server return codes.

In one of the embodiments of the traffic flow analysis system, the block for receiving and preliminary analysis of network traffic is configured to buffer data for temporary storage.

An example of data retrieved by a DPI device is: obtaining physical host addresses (MAC address), network protocol type (IPv4 and IPv6), source and destination host IP addresses, transport protocol type (IP, ICMP, RIP, DDP, ARP and others) , source and destination port numbers, as well as LLC, value of service flags, TCP “window” value.

Examples of application layer data include remote access and resource sharing protocols, HTTP, SMTP, FTP, HTTPS, TELNET, SSH, DNS, and other well-known protocols.

The DPI device has a built-in signature database with characteristics to match analyzed traffic packets, allowing you to accurately identify the application or protocol being analyzed.

To complement the performance signature database with new applications and protocols, the performance signature database is designed to be updated and refined.

The use of a system and method with preliminary analysis of the incoming traffic flow can significantly reduce the time for checking data packets, especially in those cases in which it is most important.

For example, a delay of more than 150 milliseconds is unacceptable for two-way voice conversations and may result in communication breakdown. The acceptable time interval for no traffic can also be set; by default it is usually 25 seconds. If the time is exceeded, this traffic will refer to a new connection.

In addition, for each type of traffic and/or protocol, the user can choose to set its own permissible time interval for no traffic. In this way, the application layer data as well as the associated metadata of each network packet can be obtained.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a block diagram of a system for processing traffic using a firewall system in accordance with the present invention.

FIG. 2 shows a flow diagram of a method for processing traffic by a firewall system in accordance with the present invention and information flows between units of the system.

FIG. 3 depicts the architecture of a firewall system in accordance with the present invention.

IMPLEMENTATION OF THE INVENTION

The invention is a set of hardware and software tools that ensure the implementation of a traffic flow analysis system, which, in accordance with Figure 1 , contains the following blocks:

• 11 – block for receiving and preliminary analysis of network traffic;

• 12 – deep packet inspection device DPI;

• 13 – data clustering block;

• 14 – memory block;

• 15 – log block;

• 16 – graphical user interface, contained in one of the system implementation options.

Block 11 for receiving and preliminary analysis of network traffic is connected to DPI device 12 and is capable of preliminary analysis of the incoming traffic flow. If it is determined that the traffic belongs to an already established connection, that is, such packets with the SYN and ACK flags have already passed through block 11 for receiving and preliminary analysis of network traffic, then the packet can be passed without filtering.

The DPI device 12 parses IP protocol specification packets to obtain data at the link, network, transport and application layers. The DPI device 12 is configured to extract used application protocols, tunneled IP addresses, user names, file names, HTTP links and request URLs, and server return codes from the traffic.

Examples of data extracted from a traffic flow include: obtaining physical host addresses (MAC address), network protocol type (IPv4 and IPv6), source and destination host IP addresses, transport protocol type (IP, ICMP, RIP, DDP, ARP and others ), source and destination port numbers, as well as LLC, value of service flags, TCP “window” value. Examples of application layer data include remote access and resource sharing protocols, such as HTTP, SMTP, FTP, HTTPS, TELNET, SSH, DNS, and others.

In this way, the application layer data as well as the associated metadata of each network packet can be obtained. A 12 DPI device has its own unique characteristics, which are recorded in the built-in signature database. Comparison of a sample from the database with the analyzed traffic allows you to accurately determine the application or protocol. But as new applications and protocols appear periodically, the signature database also needs to be updated to ensure high identification accuracy.

Data clustering block 13 is used to divide data packets into groups (clusters) of similar objects to simplify further data processing and decision making. In this case, each group of data can have its own analysis method applied.

The operation of a firewall system is determined by a set of rules, such as Suricata (Suricata is an open source intrusion detection system (IDS) and intrusion prevention system (IPS) developed by the Open Information Security Foundation (OISF)), which can be stored in block 14 memory. For each cluster, they create and set their own processing rules, different from other clusters. Thus, chains are formed into which clusters are redirected for subsequent processing.

For the system to work, it is enough to create one general rule for a specific cluster, and then redirect clusters from it into separate chains. Clusters can also be redirected from one own chain to another. This allows you to optimize the processing of network traffic, since each packet from the cluster is processed according to its own rules. In addition, information on any package is simultaneously sent to block 15 of the log book. Also, the traffic flow analysis system is configured so that packets are not discarded, but are sent to block 13 for subsequent re-clustering if any inconsistencies with the rules are detected. Based on the temporary storage of files in a buffer (not indicated in the figure), block 11 for receiving and preliminary analysis of network traffic checks that such a packet has already passed through and makes a mark so that when re-clustering the packet is sorted, it will be placed in another cluster, and only after reprocessing was discarded. Periodically, the established rules for processing a network packet are refined depending on the passing traffic and the resulting clusters.

In a preferred embodiment of the invention, the firewall system includes a graphical user interface 16 . In this case, it is possible not to discard the packets, but to forward them to the graphical user interface 16 , where it will be checked by the system administrator. The system administrator can take all the information about network traffic directly from block 15 of the log, he can also skip the packet manually and send it to block 11 for receiving and preliminary analysis of network traffic, and then add clarification about the packet to block 15 of the log.

Log block 15 collects data about each packet (including dropped ones) that comes from device 12 DPI.

In a preferred embodiment of the invention, the data for analysis is metadata. Storing metadata without actual content is approximately 1/100th the compression ratio of raw network traffic and significantly increases the amount of packet information stored.

The advantage of the proposed system is also that information about identified atypical packets in clustering block 13 can be immediately sent to log block 15 .

In one use case, a traffic flow analysis system is used as an intrusion detection method and/or system (ID).

A method for analyzing traffic flow is implemented using a block for receiving and preliminary analysis of network traffic, in which incoming traffic is received and analyzed, which is connected to a block for identifying new devices, a device for deep inspection of DPI packets, a signature block and a memory block, characterized in that the receiving block and preliminary analysis is connected to a deep packet inspection device DPI, a memory block and a block for detecting new devices and a signature block connected to it, while the block for receiving and parsing traffic is connected to a block for identifying new devices.

The intrusion detection method in accordance with Figure 2 is performed in a hardware and software complex, which is a traffic flow analysis system, which includes the following blocks:

• 21 – block for receiving and parsing network traffic;

• 22 – block for identifying new devices;

• 23 – signature block;

• 24 – memory block.

The memory block 24 is designed to store various information and sets of rules in accordance with the information security policy and is connected to a block for identifying new devices and a signature block.

Block 21 for receiving and parsing network traffic is used to collect network traffic at the data link level, that is, traffic coming from the global Internet or traffic that passes within the enterprise network, for example, over a local network and for its further parsing in accordance with the structure of the stack packet IP/TCP. To parse a packet, packet parsing tools can be used at the network and transport layers, or at the network, transport and application layers. First, incoming traffic is broken down into TCP, UDP or other transport streams, after which the parsers label them and break them down into high-level protocols and their fields, normalizing if necessary. The resulting decoded, decompressed and normalized protocol fields are then sequentially checked by blocks 22 and 23 for the presence of network attacks or malicious activity in the network traffic.

Block 22 for identifying new devices is used to identify and control network devices between which data is exchanged and transmitted on the network. A network device can be identified on a network by its network address, such as an IP address, MAC address, URI (Uniform Resource Identifier) or any other network identifier. Thus, network traffic is transmitted only between identified devices. The decision to allow or block outgoing or incoming traffic is made by block 22 for identifying new devices based on the presence of a network device identifier in memory block 24 . If the identifier characterizing the network device is contained in the memory block 24 , then the traffic is allowed; otherwise, the traffic is blocked.

To determine network attacks, the intrusion detection system contains a signature block 23 , which, when checking a packet, accesses a memory block 24 with signatures of known attacks.

A signature is a continuous finite sequence of bytes that is necessary and sufficient for unambiguous identification of threats. If any code of the program being viewed matches a known virus code in memory block 24 , a decision is made to block the package. In the preferred embodiment, the contents of the packets under study are compared not directly, but using their checksums, which can significantly reduce the number of stored records about known viruses. It will be clear to one skilled in the art that to improve the effectiveness of threats, the database of known viruses must be constantly updated, as new malicious codes and threats appear daily.

The signature of a network attack is practically no different from the signature of a virus and is a set of characteristics that allows one to distinguish a network attack from other types of network traffic. For example, conflicting TCP packet flags: SYN and FIN can be set simultaneously. This combination of flags is used in many attack programs to bypass filters and monitors that only check the setting of a single SYN flag. The presence of the line “GET.cgi-bin./etc/passwd” in the data area of the HTTP packet indicates the exploitation of a PathTraversal type vulnerability. Finally, the TCP packet header may have the destination port 139 and the OOB (Out of Band) flag set, which is a sign of a WinNuke attack.

In accordance with Figure 3, in the traffic flow analysis system in accordance with the present invention, additional functions can be implemented:

• 30 – packet filtering;

• 31 – routing;

• 32 – intrusion detection function (IDS or IDS according to industrial protocols);

• 33 – creating a failover cluster;

• 34 – streaming antivirus;

• 35 – management and configuration of network interfaces;

• 36 – virtual private network (VPN);

• 37 – integration with Active Directory;

• 38 – domain name systems (Domain Name System, DNS);

• 39 – web server function.

Claims (10)

1. The traffic flow analysis system contains a block for receiving and preliminary analysis of network traffic, a block for identifying new devices, a device for deep inspection of DPI packets, a signature block and a memory unit, characterized in that the block for receiving and preliminary analysis is connected to a device for deep inspection of DPI packets and is executed with the possibility of preliminary analysis of the incoming traffic flow, and if the DPI deep packet inspection device determines that the traffic belongs to an already established connection, that is, such packets with the SYN synchronization and ACK confirmation flags have already passed through the control unit, then the packet can be passed without filtering. 2. The system according to claim 1, in which a graphical user interface is additionally implemented. 3. The system according to claim 1, in which if the packet belongs to a new connection, then it is sent to a DPI device for parsing packets, which parses packets with the Internet Protocol specification to obtain data on the link, network, transport and application levels. 4. The system of claim 1, wherein the DPI device is capable of retrieving known application protocols in use, tunneled IP addresses, user names, file names, HTTP links and request URLs, server return codes. 5. The system according to claim 1, in which the traffic flow analysis systems of the reception and preliminary analysis of network traffic are configured to buffer data for temporary storage. 6. A method for analyzing traffic flow, implemented using a block for receiving and preliminary analysis of network traffic, in which incoming traffic is received and analyzed, which is connected to a block for identifying new devices, which identifies and controls network devices exchanging and transmitting data in the network, the device deep inspection of DPI packets, with the help of which they compare samples from the database with the analyzed traffic and determine the application or protocol, which then sequentially checks the resulting decoded, decompressed and normalized protocol fields using a signature block and a memory block for the presence of network attacks or malicious code in the network traffic activity, characterized in that the receiving and preliminary analysis unit is connected to a DPI deep packet inspection device and is capable of preliminary analysis of the incoming traffic flow, and if the DPI deep packet inspection device determines that the traffic belongs to an already established connection, that is, through the block control has already passed such packets with the SYN synchronization and ACK confirmation flags, then the packet can be passed without filtering. 7. The method according to claim 6, in which the results of the work are sent to the graphical user interface. 8. The method according to claim 6, wherein if the packet refers to a new connection, it is sent to a DPI packet parsing device, which parses Internet Protocol specification packets to obtain data on the link, network, transport and application levels. 9. The method of claim 6, wherein the DPI device retrieves known application protocols in use, tunneled IP addresses, user names, file names, HTTP links and request URLs, server return codes. 10. The method according to claim 6, in which the network traffic receiving and preliminary analysis unit of the traffic flow analysis system buffers data for temporary storage.