CN106899612B

CN106899612B - Method for automatically detecting ARP spoofing of fake host

Info

Publication number: CN106899612B
Application number: CN201710213100.6A
Authority: CN
Inventors: 吉杰; 蔡伟鸿; 翁楚强; 姚佑川
Original assignee: Shantou University
Current assignee: Shantou University
Priority date: 2017-04-01
Filing date: 2017-04-01
Publication date: 2020-01-24
Anticipated expiration: 2037-04-01
Also published as: CN106899612A

Abstract

The embodiment of the invention discloses a method for automatically detecting ARP spoofing of a fake host, which comprises a data acquisition method and an ARP spoofing detection method, wherein a data acquisition program automatically and regularly acquires an ARP table of three layers of equipment by using an SNMP protocol and stores the ARP table in a database, the detection method comprises two stages of primary screening and analysis and confirmation, the primary screening acquires records that the number of different IP addresses corresponding to one MAC address in the database is greater than a certain threshold value, then each MAC address of a primary screening result is analyzed and confirmed, and the ARP spoofing is confirmed after special conditions of network equipment such as a router and the like and special conditions of a plurality of virtual machines operated by one computer and the like are eliminated through a white list, the value of an iNetToMediaType is analyzed, the distribution range of the IP addresses and the temporal change rule are analyzed and the like.

Description

Method for automatically detecting ARP spoofing of fake host

Technical Field

The invention relates to the technical field of network communication, in particular to a method for automatically detecting ARP spoofing of a fake host.

Background

ARP is a short name for Address Resolution Protocol, i.e. Address Resolution Protocol, and its function is to provide dynamic mapping between ip (internet Protocol) Address and mac (media Access control) Address. The initial design of the ARP protocol assumes that the hosts and packets in the network are trusted, but this is far from the true, ARP spoofing poses a huge security risk to the network security, many local Area networks (lan) are deeply harmed, some ARP spoofing is caused by viruses, and some are artificially and carefully designed network attacks of illegal interception and malicious impersonation.

Many approaches have been taken to combat ARP spoofing: the method comprises the steps of installing an ARP firewall on a computer, binding MAC-IP addresses in a computer and a gateway in a bidirectional mode, detecting ARP spoofing by a network administrator through network packet capturing, operating a switch to seal a port of the switch after discovering the ARP spoofing, starting DHCP Snooping IP Source Guard (IP Source address protection) and DAI (Dynamic ARP Inspection Dynamic ARP instruction) on network equipment, analyzing an ARP table of a router to detect the ARP spoofing and the like. However, the above methods all have some disadvantages: the ARP firewalls are installed on a user computer and are difficult to manage in a centralized way, the ARP firewalls are not defended by people, and even some ARP firewalls are attacked to resist the attack so as to bring harm to the whole network; the maintenance workload of the bidirectional binding MAC-IP is huge, and the bidirectional binding MAC-IP cannot adapt to more and more notebook computers and WiFi environments; only ARP spoofing which is currently generated can be detected through network packet capturing, ports need to be frequently switched or different port mirror images need to be configured in different network segments monitored in a switching network, the packet capturing analysis workload is large, and higher technical requirements are imposed on a network administrator; the DHCP Snooping, the IP Source Guard and the DAI are enabled to have higher requirements on the whole network environment and switch equipment, many middle and low-end switches (such as Cisco 2960) do not support the DHCP Snooping, and in addition, the IP Source Guard still needs to statically bind the MAC-IP in the network environment with the coexistence of the static IP and the DHCP manually set; besides the DAI, many other methods for preventing ARP spoofing are also "intrusive" to the existing network, require changing network protocols, require changing existing network devices, and are even theoretically perfect and difficult to popularize in reality; some 'non-invasive' methods for detecting fake host ARP spoofing by analyzing ARP tables of routers exist at present, but some of the methods do not store the ARP tables of the routers in a database, other methods lose history records or reduce system performance because a large amount of repeated data is stored because the optimal strategy for storing MAC-IP in the database is not found, and the existing methods can cause misjudgment because special conditions such as MAC addresses of gateways, computers running multiple virtual machines, notebook computers, mobile offices and the like are not eliminated.

Disclosure of Invention

The technical problem to be solved by the embodiments of the present invention is to provide a method for automatically detecting ARP spoofing of a fake host. The invention can be adapted to various network environments and network devices without misjudgment.

In order to solve the above technical problem, an embodiment of the present invention provides a method for automatically detecting ARP spoofing of fake hosts, including a data acquisition method and an ARP spoofing detection method, where the data acquisition method includes, for each acquired MAC-IP record, first querying a latest timestamp whose MAC address is equal to the MAC address in an original record of a database or querying a maximum self-growth field number whose MAC address is equal to the MAC address, then querying a record whose MAC address is equal to the MAC address and whose timestamp is equal to the latest timestamp in the original record or querying a record whose value of a self-growth field is equal to the maximum self-growth field number just queried, if the record exists and whose IP address is equal to the acquired IP address, updating the timestamp of the original record to be the current time, otherwise inserting a new record; the ARP spoofing detection method comprises the steps of detecting different IP address numbers corresponding to the MAC addresses, and adding a suspected ARP spoofing list when the number exceeds a set threshold value.

Further, the ARP spoofing detection method also comprises the step of analyzing and confirming each suspected ARP spoofing which is preliminarily screened, wherein an elimination method is adopted in the confirmation process, and the conditions of MAC addresses of network equipment such as a router and the like, running of a plurality of virtual machines by one computer and the like are eliminated in at least one mode of a white list, an analysis value of an iNetToMediaType, an analysis distribution rule of an IP address and a temporal change rule, so that whether the suspected ARP spoofing exists is finally confirmed.

Furthermore, the threshold value range is 2-10, and the default value is 3.

The embodiment of the invention has the following beneficial effects: the invention can be suitable for various network environments and network equipment, has no invasion to the existing network, can process various complex conditions, avoids generating misjudgment, saves the latest record of the MAC-IP address and keeps the historical change in a database, can meet the subsequent requirements of preliminary screening, analysis, confirmation and query, and can keep good performance of the system because a large number of repeated records are not saved, and a common server can support the automatic detection of the ARP spoofing of a large-scale network consisting of thousands of network equipment (switches and routers) and hundreds of thousands of computers.

Drawings

FIG. 1 is a block diagram of automatic detection of spoofed host ARP spoofing;

FIG. 2 is a schematic diagram of a partial data dictionary of a database;

FIG. 3 is a flow chart of a data collection program collecting ARP tables and saving them to a database;

FIG. 4 is a flow chart of an algorithm for detecting spoofed host ARP spoofing.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail with reference to the accompanying drawings.

The embodiment of the invention discloses a method for automatically detecting ARP spoofing of a fake host, a topological structure diagram is shown in figure 1, the method comprises a data acquisition method and an ARP spoofing detection method, and the detection method comprises primary screening and analysis and confirmation.

1. Data acquisition program

The data acquisition program automatically and regularly acquires an ARP table of three-layer equipment (equipment working on a third layer of a TCP/IP protocol, such as a router, a three-layer switch, a firewall and the like) by using an SNMP protocol and stores the ARP table into a database, wherein the acquisition frequency is less than the expiration time of the ARP table of the equipment (usually 20 minutes by default), otherwise, data may be lost, and the sampling frequency is usually set to be 10 minutes.

There are two main ways for a program to collect an ARP table of a network device: snmp (simple Network management protocol) protocol and cli (command Line interface) command Line. The CLI command line is originally used for a man-machine interaction process, and has a plurality of defects for collecting an ARP table, firstly, the command line mode has poor adaptability to equipment, the types of equipment instructions of different manufacturers are completely different, even if the same equipment needs different instruction sequences to be input when software configuration is different, in addition, the program uses the command line mode to obtain the ARP table, a plurality of steps are required to be executed, the steps comprise connecting to a switch (TELNET/SSH), inputting an account number, inputting a password, entering a configuration mode, executing a command show ip ARP (equipment of Cisco) or disp ARP, analyzing a returned result and the like, particularly, when the number of ARP entries is large, page turning operation is required for a plurality of times, the flow is complex, and the performance is low.

The invention adopts SNMP mode to collect data, the current network equipment supports SNMP protocol, because the collection of ARP table does not relate to private MIB (management Information base), the collection of ARP table of network equipment and the manufacturer model of equipment and software configuration are completely irrelevant. The SNMPv2 provides Get-Bulk primitives that enable data to be obtained in a batch manner, greatly reducing the number of interactions between applications and network devices, improving performance and simplifying programming. According to the original standard RFC1213 ARP table corresponding to MIB is IPNetToMediaTable and new standard RFC4293 is IPNetToPhysicalTable, the invention is explained by the currently commonly used IPNetToMediaTable, one IPNetToMediaTable can contain a plurality of iNetToMediaEntry (OID: 1.3.6.1.2.1.4.22.1), each of which includes the following data items:

1.3.6.1.2.1.4.22.1.1 - ipNetToMediaIfIndex

1.3.6.1.2.1.4.22.1.2 - ipNetToMediaPhysAddress

1.3.6.1.2.1.4.22.1.3 - ipNetToMediaNetAddress

1.3.6.1.2.1.4.22.1.4 –ipNetToMediaType

2. database design

As shown in fig. 2, the core part of the database data dictionary is a basic information table for storing connection parameters and device models of network devices, including fields such as IP addresses, SNMP port numbers, SNMP Community String, etc., and the names and types of the fields in the ARP table refer to the names and types of corresponding items in the MIB, except for the additional addition of fields such as IP and timestamps of the network devices.

3. Data acquisition program database saving algorithm

If every acquired MAC-IP entry is written into the database, the data volume is too large, taking Shantou university as an example, more than ten thousand MAC-IP records are taken out from the router every time, and if the sampling frequency is ten minutes, the data volume in one day exceeds millions, but most of the data are repeated, so that the data are not useful for detecting ARP spoofing and can seriously affect the performance. If only the ARP data collected at the last time is reserved, although the data volume is greatly reduced, and the condition that one MAC corresponds to a plurality of IPs at the current moment can be detected, because the historical change rule of the MAC-IP is not stored, the method is difficult to cope with the intermittent ARP spoofing, the IP normally used by a certain MAC address before the ARP spoofing is initiated cannot be judged, and particularly the follow-up detection algorithm cannot distinguish the complex conditions that one computer runs a plurality of virtual machines and the like through the temporal change rule of the MAC-IP.

Aiming at the problems, the method of the invention calls a database storage process by a data acquisition program, and realizes the business logic of saving MAC-IP to the database in the storage process: judging each MAC-IP entry, firstly inquiring the latest timestamp (or inquiring the maximum self-increment field number of the MAC address) of which the MAC address is equal to in the original record of the database, then inquiring the record (or inquiring the record of which the value of the self-increment field is equal to the maximum self-increment field number just inquired) of which the MAC address is equal to in the original record and the timestamp is equal to the latest timestamp, if the record exists and the IP address is equal to the acquired IP address, updating the timestamp of the original record to be the current time, otherwise, inserting a new record. Therefore, the database can not only store a large number of repeated MAC-IP records, but also store the latest MAC-IP entries and the historical change conditions of the MAC-IP entries. The algorithm flow chart is shown in fig. 3.

The service logic that stores the MAC-IP to the database has the following characteristics: the input and output data volume is very small, but the intermediate process has a service flow and involves more data, for such a scenario, the use of the storage process can greatly reduce the interaction times and the interaction data volume of the program and the database, and the implementation of the service logic in the storage process is much better than the implementation in the client or the application server.

4. Method for detecting false host ARP spoofing

The detection principle is that when ARP spoofing of a spoofed host occurs in a network, a situation that one MAC address (MAC address of an ARP spoofer) corresponds to multiple IP addresses (one is a normally used IP, and the other is a spoofed IP of another host) occurs in an ARP cache table of a three-layer device (usually a router), but not all one MAC corresponds to multiple IPs and is ARP spoofing, and various complex situations need to be eliminated. The detection method disclosed by the invention comprises primary screening and analysis confirmation, and the flow chart is shown in a figure 4.

Theoretically, the MAC address is fixed on the network card (although the operating system can also be modified), and ARP spoofing generally does not change the MAC address, because the purpose of ARP spoofing is to intercept and spoof, it is meaningless to change the MAC address frequently, even if there is theoretically ARP spoofing that changes MAC and IP simultaneously (in reality, there is almost no ARP spoofing), it can be prevented easily by limiting the number of MAC addresses that access the switch port, so detecting ARP spoofing of a spoofed host starts with one MAC address corresponding to multiple IP addresses, and not vice versa.

Because the data acquisition program stores the ARP table of the router in the database, only one SQL statement (utilizing group by and changing clauses) can screen the condition that one MAC address corresponds to a plurality of different IP addresses. A threshold value (the value of the threshold value is between 2 and 10, the default value is 3) needs to be set, the next judgment is carried out when the IP number corresponding to one MAC address is larger than the threshold value, the conditions that a notebook computer is used in a cross-network segment, the IP addresses are normally switched and the like are eliminated, and then each MAC address which is preliminarily screened is analyzed and confirmed.

Firstly, the MAC address of a network device such as a router itself may be a plurality of IP addresses, which are gateway addresses, because one MAC address of the router needs to perform data forwarding between a plurality of network segments (or subnets). There are various processing methods for the MAC address of a network device such as a router: the first is manual white listing and the second is automatic identification. There are two methods for automatic identification: and analyzing the distribution rule and the temporal change rule of the IP address according to the value of the iNetToMediaType. The MAC-IP of the router is static, the router is not dynamically learned through an ARP protocol, the value of ipNetToMediaType is 4 in the MIB, and if static MAC-IP binding is not carried out on the router, the MAC-IP of the router can be judged according to the value of the ipNetToMediaType. Even if the router is subjected to static MAC-IP binding, the MAC address of the router cannot be automatically judged through the iNetToMediaType, and the MAC and ARP spoofing of the router can be distinguished by analyzing the distribution rule and the temporal change rule of the IP address. The behavior mode that one MAC address of the router corresponds to a plurality of IP addresses is obviously different from the common ARP spoofing, because the ARP spoofing can not cross network segments, if the IP belongs to different network segments, the ARP spoofing can be eliminated, different subnets can not be automatically distinguished for the network environment of some divided subnets, the judgment can be carried out according to the temporal change rule of the IP addresses, and the judgment method is the same as the following method for judging a computer which runs a plurality of virtual machines.

If a certain computer is provided with virtual machine software (such as VMware, Hyper-V and the like), a virtual network operates in a bridge mode, and a plurality of virtual machines operate, so that the condition that one MAC address corresponds to a plurality of IPs occurs, because the virtual machine software simulates a plurality of virtual network cards which need to read and write data from a physical network card, the condition that a plurality of IPs correspond to the same physical MAC is avoided, and the condition is more and must be distinguished along with the popularization of virtualization.

Generally, an ordinary computer only runs one or two virtual machines, the situation is eliminated by setting a threshold value, and for few extreme situations, the situation can be distinguished by analyzing the temporal change rule of an IP address. Although one MAC of a computer running multiple virtual machines corresponds to multiple IPs, the corresponding relation is very regular, when a certain moment corresponds to multiple different IPs, the next moment always corresponds to the IPs, and the corresponding relation of multiple MAC-IPs appears in an ARP table of a database in a circulating way. The MAC-IP of the multiple virtual machines changes slowly along with time, only the virtual machines are added or deleted, and the shutdown time exceeds the ARP expiration time, but real ARP deception exists, the number of corresponding IP of the MAC is very large (more than 10), the temporal change of the MAC-IP is frequent and disordered, and the temporal change rule of the IP addresses can be obviously distinguished.

The invention has the following advantages:

1. the method can be suitable for various network environments and network equipment, and has no invasion to the existing network.

The technical means is as follows: and using an SNMP protocol to regularly acquire an ARP table of the router and store the ARP table in a database, and detecting ARP spoofing of a fake host by analyzing the corresponding relation of the MAC-IP addresses.

2. The latest record of the MAC-IP address is stored in the database, the historical change is also kept, the subsequent preliminary screening, analysis and confirmation query requirements can be met, a large number of repeated records are not stored in the database, the system performance is good, and one common server can support the automatic detection of the ARP spoofing of a fake host of a large network consisting of thousands of network devices (switches and routers) and hundreds of thousands of computers.

The technical means is as follows: the data acquisition program calls a database storage process, and the storage process realizes the business logic of storing the MAC-IP into the database: judging each MAC-IP entry, firstly inquiring the latest timestamp (or inquiring the maximum self-increment field number of the MAC address) of which the MAC address is equal to in the original record of the database, then inquiring the record (or inquiring the record of which the value of the self-increment field is equal to the maximum self-increment field number just inquired) of which the MAC address is equal to in the original record and the timestamp is equal to the latest timestamp, if the record exists and the IP address is equal to the acquired IP address, updating the timestamp of the original record to be the current time, otherwise, inserting a new record.

3. Can process various complex conditions without generating misjudgment

The technical means is as follows: the ARP spoofing of the fake host is detected by two steps of primary screening and analysis and confirmation, the primary screening analyzes records that the number of different IP addresses corresponding to one MAC address is larger than a certain threshold value, and normal conditions of cross-network-segment use, IP address switching and the like of the notebook computer are eliminated by setting the threshold value. In the analyzing and confirming step, the MAC addresses of network equipment such as a router and the like and the complex conditions that one computer runs a plurality of virtual machines and the like are eliminated in a white list mode, an IPNetToMediaType value mode is analyzed, an IP address distribution rule and a temporal change rule are analyzed and the like.

While the invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not to be limited to the disclosed embodiment, but on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A method for automatically detecting ARP spoofing of a fake host is characterized by comprising a data acquisition method and an ARP spoofing detection method, the data acquisition method comprises the steps of firstly inquiring the maximum timestamp or the maximum self-increment number of the MAC address in the original record of the database for each acquired MAC-IP record, then querying the original record for a record with a MAC address equal to the MAC address and a timestamp equal to the latest timestamp or querying the record with a value of the self-growth field equal to the maximum self-growth field number just queried, if the record exists and the IP address of the record is equal to the acquired IP address, the timestamp of the original record is updated to be the current time, otherwise, a new record is inserted, the ARP spoofing detection method comprises the steps of detecting different IP address numbers corresponding to each MAC address, and adding a suspected ARP spoofing list when the number exceeds a set threshold value.

2. The method according to claim 1, wherein the ARP spoofing detection method further comprises analyzing and confirming each suspected ARP spoofing preliminarily screened, and the confirmation process adopts an exclusion method to exclude the MAC address of the network device itself and the situation that one computer runs a plurality of virtual machines, and finally confirm whether the ARP spoofing is present or not, by at least one of white list, MAC-IP address mapping type analysis, IP address distribution rule analysis and temporal change rule analysis.