CN104104675A

CN104104675A - Internet control message protocol camouflage capture and analysis technology

Info

Publication number: CN104104675A
Application number: CN201410312275.9A
Authority: CN
Inventors: 赖洪昌
Original assignee: Individual
Current assignee: Individual
Priority date: 2014-06-24
Filing date: 2014-06-24
Publication date: 2014-10-15

Abstract

The invention relates to an Internet control message protocol camouflage capture and analysis technology. The technology comprises the following operation steps: (1) data packet decoding and filtering, (2) data packet recombination, (3) ICMP scanning attack detection, and (4) protocol camouflage detection. According to the technology, IP data packets with the protocol type of ICMP are captured via decoding and filtering network data packets, and the complete IP data packets are obtained via recombination of the data packets. The complete IP data packets are filtered by an ICMP scanning attack detection module and then transmitted to a protocol camouflage detection module which analyzes the data packets according to different types, codes and contents in ICMP protocol heads so that a result that whether the data packets are camouflage protocol data packets is obtained. Compared with technologies in the prior art, the technology is closely combined with practical application situations and easy to realize so that large data can be detected in a high-speed and high-efficiency way, the hidden ICMP protocol data can be timely discovered and the requirement for practical application can be met.

Description

Internet Control Message Protocol camouflage is caught and analytical technology

Technical field

The present invention relates to Internet Control Message Protocol camouflage and catch and analytical technology, belong to Computer Applied Technology field.

Background technology

Along with develop rapidly and the expansion of computer networking technology, the particularly fast development of Internet in recent years, increasing people have felt the importance of network security.Simultaneously in the world, for the intrusion behavior of important information resource and network infrastructure and the quantity of attempt intrusion behavior still in constant increase.In addition, prism door event, allows complexity, the threat hidden and tool destructive power that people face for network security have understanding more clearly.

Along with lost network attack and invasion row are constantly exposed the impact causing of national security, economy, social life, effectively the information security communication technology also becomes very important problem.So a kind of novel Cyberthreat recognition technology is arisen at the historic moment, it has realized analysis and the identification of agreement camouflage on traditional network invasion monitoring basis, and it can find to be hidden in the network intrusions behavior of the proper communication agreement that disguises oneself as in mass data.So far,, in order better to find hidden Internet Control Message Protocol Camouflaged data, we have invented " Internet Control Message Protocol camouflage is caught and analytical technology ".

Summary of the invention

In order effectively to find to be hidden in the ICMP agreement camouflage intrusion behavior in mass data, lower loss and impact that concealed intrusion behavior brings.The embodiment of the present invention provides Internet Control Message Protocol camouflage to catch and analytical technology.Improve energetically described in secret communication behavior ability of discovery technical scheme with this as follows:

1.Internet Internet Control Message Protocol (ICMP) camouflage is caught and analytical technology, its feature is mainly manifested in packet restructuring and pretends with agreement the core process of analyzing, ICMP packet can be caught and be obtained by bottom packet capturing technology: (1) filters out IP protocol data bag from network packet, whether analyzing IP packet is packet segment, if the packet of burst, transfer to so the processing of packet recombination module, not the packet of burst, transfer to the processing of agreement camouflage analysis module; (2) whether the analysis of packet recombination module is current is last IP fragmentation packet, if current all IP fragmentation packets are recombinated, so the complete IP bag after reconfiguring is transferred to the processing of agreement camouflage analysis module; (3) decoding ICMP protocol header part, analyzes ICMP request or acknowledgement type, ICMP command code, data packet length, draws whether be the ICMP packet of camouflage; Its concrete operation step is as follows:

(1) Packet Filtering

1. filter Ethernet data bag: from nautical mile packet, filter out IP packet;

2. whether burst IP bag judges: detect whether current IP packet is fragment packets, if fragment packets is transferred to the processing of packet recombination module; If not fragment packets, transfer to the processing of agreement camouflage detection module;

(2) packet recombination module processing

Whether 1. search is new packet grouping: by source IP, come source port, object IP, destination interface and do HASH computing and draw a HASH value, whether search in packet grouping chained list by this HASH value is new grouping, if, create a new grouping and add grouping chained list to, if not, be so just inserted in the burst chained list of existing grouping according to the cheap amount order in burst flag bit;

Whether finish receiving: check whether current IP packet is last fragment packets, and if so, that just represents that current group has received all fragment packets, can carry out the restructuring of packet if 2. detecting packet data package;

3. packet restructuring: all fragment packets of current group are synthesized to a new IP packet according to the side-play amount der group in burst flag bit;

(3) camouflage of ICMP agreement is analyzed

1. the ICMP packet of decoding: according to ICMP protocol header structure decoding current I CMP packet, obtain ICMP type, code, verification and and different content dissimilar and that code is corresponding,

2. inspect-type type corresponding different code and the content different from code corresponding relation: ICMP; If type is not mated with code, it is exactly the packet of camouflage so;

3. scope of examination length: check whether PING order length exceedes 64 bytes, error message and whether be less than whether 8 byte errors headings, time inquiring message are less than 20 byte headings, whether mask query message is less than 12 byte headings, if so, it is exactly the packet of camouflage;

Below that technology of the present invention is further described:

Described packet restructuring, refer to the MTU (MTU) that exceedes Ethernet due to data packet length, IP layer will carry out Fragmentation to packet so, make the length of every a slice all be less than or equal to MTU, and packet restructuring is exactly by the IP packet of burst arrival is carried out to buffer memory, by the time after gathering all packet segments, it is reconfigured, generate a new complete packet, because its flow is conventionally larger, the impact of recombinating on performance in order to reduce packet, therefore the technology of the present invention has adopted memory pool reuse technology, the way that HASH table fast finding technology is combined with buffer memory linked list order memory technology.Organizational form when IP fragmentation and reassembly is stored by a hash table, and the grouping chained list of different headings is stored in hash table, does not have a grouping storage of linked list to have the burst chained list of identical heading.

Described ICMP agreement camouflage is analyzed:

1) to IP decoded packet data, obtain type in ICMP protocol header, code, verification and and content-data, due to different types, the corresponding different content of code, whether type of detection mates with code the ICMP packet that can find that part is pretended.

2) check ICMP data packet length.Whether by whether dissimilar, code check content-length are met to normal behaviour uninterrupted, detecting is agreement Camouflaged data.Such as normal type 0, code 0 represent the echo order of PING, its normal size can not exceed 64 bytes, and if there is the PING packet that exceedes 64 bytes, it may be just that the PING program of pretending is informed user so.

The present invention compares with existing Intrusion Detection, has following outstanding feature and remarkable advantage:

(1), for traditional Intrusion Detection, the protocol contents to packet and behavior have been carried out analyzing targetedly, can effectively detect hidden intrusion behavior.

(2) adopt various protocols camouflage test point to combine, greatly strengthened the practicality of function.

Brief description of the drawings:

Fig. 1 is the decoded packet data flow chart of the technology of the present invention.

Fig. 2 is the IP packet restructuring flow chart of the technology of the present invention.

Fig. 3 is the ICMP agreement camouflage overhaul flow chart of the technology of the present invention.

Fig. 4 is organization chart when IP packet is recombinated in the technology of the present invention.

Concrete practice mode:

Embodiment:

Technical scheme for a better understanding of the present invention, existing chart in by reference to the accompanying drawings just concrete implement to be explained in further detail as follows:

The camouflage of operation accompanying drawing Internet Control Message Protocol is caught with the concrete operation step of analytical technology as follows:

(1) decoded packet data---(Packet Filtering operating procedure, as shown in Figure 1)

1. the ether bag of decoding: filter Ethernet data bag according to data link.

2. decoded ip packet: according to network type decoded ip packet, ARP packet, other packet.

3. verification and inspection: calculate IP verification and whether normal.

4. decoding network layer data bag: according to protocol type decoding tcp data bag, UDP message bag, ICMP packet

(2) packet restructuring---(packet reorganization operation step, as shown in Figure 2)

1. judge whether fragment packets: detect IP fragmentation standard for whether being fragment packets, and cheaply whether amount is greater than zero.

2. judge that whether IP packet is overtime: when transmission data block, detect current IP packet and whether be less than minimum life span.

3. search heading: in existing grouping hash table, search and whether have congenial heading grouping, do not find and just create new grouping, be inserted into hash table, be just inserted in burst chained list by side-play amount if existed.Hash table structure as shown in Figure 4.

4. determine whether last burst: whether detect current packet segment is last fragment data of identical heading, if last burst just reconfigures current burst chained list, generate a new complete IP packet.

(3) agreement camouflage detects---and (agreement camouflage detects operating procedure, as shown in Figure 3)

1. the ICMP protocol header of decoding: decode ICMP type, code, verification and, data content field value.

2. whether inspect-type mates with code: check whether ICMP type mates with code value, the error message code value that is 3 such as type is less than 15, type is that 0 query message is PING packet etc., type is 13,14 time inquiring message, code value is 0, and content-length is greater than 20 bytes; Type be 17,18 mask query message code value be 0 and content-length be greater than 12 bytes.

Claims

(1) Packet Filtering

1. filter Ethernet data bag: from nautical mile packet, filter out IP packet;

2. whether burst IP bag judges: detect whether current IP packet is fragment packets, if fragment packets is transferred to the processing of packet recombination module: if not fragment packets, transfer to the processing of agreement camouflage detection module;

(2) packet recombination module processing

(3) camouflage of ICMP agreement is analyzed

1. the ICMP packet of decoding: according to ICMP protocol header structure decoding current I CMP packet, obtain ICMP type, code, verification and and different content dissimilar and that code is corresponding;

3. scope of examination length: check whether PING order length exceedes 64 bytes, error message and whether be less than whether 8 byte errors headings, time inquiring message are less than 20 byte headings, whether mask query message is less than 12 byte headings, if so, it is exactly the packet of camouflage.