CN112073371A - A malicious behavior detection method for weakly supervised routing devices - Google Patents

Abstract

The invention relates to the technical field of malicious behavior detection of routing equipment, and particularly provides a malicious behavior detection method for weakly supervised routing equipment, which is used for detecting and alarming malicious behaviors suffered by the routing equipment and protecting network equipment which cannot be considered by traditional security measures by loading a lightweight detection system, wherein the detection system adopts a default calling interface of a routing equipment operating system and realizes the monitoring of the routing equipment and the monitoring of data flow by utilizing the routing equipment operating system; the method has the advantages of low cost, high availability and high expansibility, and can be used for continuous development to deal with the subsequent attack threat aiming at the routing equipment in the weak supervision environment.

Description

A malicious behavior detection method for weakly supervised routing devices

technical field

The invention belongs to the technical field of malicious behavior detection of routing equipment, and particularly relates to a malicious behavior detection method for weakly supervised routing equipment.

Background technique

According to the "2019 Industrial Internet White Paper", the routing equipment contained in the Internet is estimated to be at least on the order of tens of millions. Widely deployed routing devices have become an important attack target for hackers. Attacks on routing devices emerge in an endless stream. According to the attack process, the attacks can be divided into the following stages: detection and scanning, password guessing, vulnerability attacks, device backdoors, and covert tampering of configurations. In recent years, attacks against Russian routing equipment have shown that a large number of attack threats have been transferred from traditional PC and mobile terminals to routing equipment.

Through the vulnerability analysis of routing devices, Jaspal Kumar et al. found that routing devices can be controlled through routing protocol vulnerabilities, and the configuration services of routing devices can be tampered with. According to the "2019 Q1 DDoS Attack Report", a large number of Mikrotik routers and Huawei routers were attacked by the Mirai virus from 2018 to 2019, and a large number of Cisco devices were implanted into the EEm Event Manager (Embeded Event Manager, EEM) backdoor.

Compared with terminals and mobile terminals, routing equipment is widely deployed, with large differences in geographical locations, and uneven operation and maintenance measures and security measures. Except for core node equipment with certain security measures, a considerable part of routing equipment is in a weak supervision environment. It is easy to be implanted with backdoors, and the loopholes in the equipment cannot be repaired in time, and they face the threat of malicious attacks in the network environment. In response to the above problems, scholars such as M. I. Mazdadi proposed a security protection mechanism based on honeypot intrusion detection as the main means, and provided relevant technical support for the installation of intrusion detection systems on routing equipment. However, for routing devices deployed in special locations, it is difficult to deploy honeypot devices or monitoring servers, and there is a high attack rate of false negatives.

J. M. Ceron has carried out research on digital forensics and honeypot technology for routing equipment, long-term tracking of routing equipment log management system, and detailed research and analysis on the principles of routing log management engines and management software such as kiwi syslog, bnare backlog, and spectorosoft.

Scholars such as C. Marrison conducted forensic analysis on multiple models of routing equipment, including Cisco, TP-link, H3C, Huawei, and Mikrotik. Most of the research on routing devices mainly extracts physical fingerprint information and device attribute information, and also analyzes the log records of some routing devices. M. Niemierz and J. Schwenk tested and evaluated routing devices from four different manufacturers and showed how these devices were subjected to cyberattacks.

M. Antonakakis et al. made statistics and analysis on the attack mode and attack effect of routing equipment through long-term observation and experiment of routing equipment. By comparing the experimental results of relevant researchers, it is found that no matter what attack method the attacker uses, it will eventually affect the control layer of the network device, and the control layer usually customizes the configuration of the target device according to the needs of the attacker. Tampering and implanting control backdoors to facilitate long-term control by attackers.

Security researchers can fully obtain detailed information about attacks on core node routing devices through mature technical means such as physical honeypots and directly connected devices, investigate the security of routing devices, provide protection strategies, and study routing devices for deployment and scientific configuration. methods to avoid possible attacks, but little research has been done on weakly supervised routing devices deployed in remote locations. Compared with core routing devices, these routing devices lack effective security monitoring, and the cost of deploying honeypots and monitoring servers is high, and it is impossible to identify attacks on routing devices in the first place.

Accordingly, the present invention designs a light-weight detection system, which can effectively identify suspicious behaviors against routing equipment and capture attack behavior characteristics by capturing changes in device internal configuration and combining with network data traffic capture and analysis.

SUMMARY OF THE INVENTION

Aiming at the defects and problems existing in the existing equipment, the present invention makes up for the deficiencies in the deployment and operation of the traditional honeypot system when targeting weakly supervised routing equipment, and provides a lightweight malicious behavior detection method based on routing equipment. It has the advantages of light weight, high ease of use, and convenient deployment, with high detection accuracy and low resource occupancy.

The scheme adopted by the present invention to solve the technical problem is: a malicious behavior detection method for weakly supervised routing equipment, which is characterized in that: detecting and alarming the malicious behavior suffered by the routing equipment; The network equipment that the security means cannot be used for protection, the detection system adopts the default calling interface of the routing equipment operating system, and uses the routing equipment operating system to realize the monitoring of the routing equipment and the monitoring of the data flow; the detection system includes: The device configuration information monitoring module and the device traffic capture module; the device information monitoring module mainly monitors the configuration information of the routing device, and uses the monitor function interface provided by the routing device to write a program hook to the state when the configuration information changes, and cooperate with Malicious behavior determination rules to determine whether the configuration information has been tampered with; the device traffic capture module utilizes the capture function in the router IOS system to set traffic filtering rules for device transit traffic by taking IP, port, and protocol as parameters. Screening, periodically grabbing traffic;

The detection system includes the following steps:

(1) During the detection period, continuously capture the data traffic of the routing device, and periodically return data to the local;

(2) At the same time, the configuration information of the routing device is monitored. According to the preset judgment rules, when the configuration information changes, it identifies and handles malicious attacks, and transmits the router data traffic when the configuration information changes to the local. Analyze data traffic;

(3) When it is determined that the malicious behavior occurs, the alarm information is fed back to the CLI interface, and the time of the malicious behavior is recorded at the same time, and the data packets in the time period of the malicious behavior are analyzed locally to identify the attack method and take countermeasures against the malicious behavior. control measures.

Further, the method for continuously capturing the data traffic of the routing device includes the following steps: (1) First, connect a traffic monitoring tool to the routing device to capture the data traffic of the routing device, and the traffic monitoring tool is provided by the TCL language calling the routing device. (2) Open up a ring buffer in the memory of the routing device; (3) Capture the data traffic in a 5-minute cycle and save it to the buffer; (4) Then transfer the data traffic of each cycle to Save it in PCAP format and send it back to the local. (5) Finally, determine whether to end the detection. If the detection continues, clear the buffer and continue to perform step (3); if the detection ends, close the buffer and the detection ends.

Further, monitoring the configuration information of the routing device includes configuration monitoring and service monitoring, where the configuration monitoring includes account increase or decrease, event planning, task execution and network interface monitoring when the routing device is running; the service monitoring includes port opening. Status, service startup and monitoring of incoming and outgoing traffic.

Further, the determination rules include the following content: 1) whether to use an illegal account to modify the configuration of the routing device; 2) whether there is an act of closing the system log when modifying the configuration of the routing device; 3) when configuring the routing device When modifying the operation, whether the time point belongs to the normal time range of the administrator's work; 4) When modifying the routing device configuration, whether the IP address of the command data source meets the restrictions of the ACL access control list; 5) When modifying the routing device configuration In operation, are there any situations in which the communication channel uses unconventional network protocols or uncommon ports.

Further, the detection system uses the TCL industrial control language, adopts the default function interface of the routing device, and establishes a connection with the routing device in the following two ways: the first is to upload the detection system program to the router flash through FTP, TFTP and other methods. In the file directory; the second is to directly transfer the detection program to the memory of the routing device for direct execution, and the program files are not stored on the experimental router.

Further, the countermeasures specifically include: 1) For the attack source address, set an ACL prevention and control strategy based on IP address, port, and network protocol; 2) For illegally opened accounts, immediately notify the administrator through the serial line. Access the device for cleaning; 3) Roll back the tampered routing device configuration information as soon as possible to restore the image saved by the administrator; 4) Upgrade the device firmware as soon as conditions permit.

Beneficial effects of the present invention: Compared with the traditional detection method of honeypot and direct-connected supervision server, the present invention has three advantages:

1) The detection system is written based on the routing device API, and most routing devices provide automatic management interfaces, so they have good versatility;

2) The detection system is easy to deploy and easy to use, and can greatly reduce operating costs for routing equipment deployed in remote locations;

3) High flexibility, real-time update and maintenance in operation and maintenance, quick response to emerging security threats, and effective detection of intrusions on routing devices.

The above detection method for weakly supervised routing devices can fully feedback the device status while ensuring the stable operation of the device, effectively monitor and alarm routing devices by loading and executing a lightweight detection system, and continuously capture attack behaviors and suspicious data. The ability can make up for the shortcomings of traditional honeypot systems in deployment and operation, and is more adaptable than other security detection methods.

The detection method adopts the default calling interface of the routing device operating system, and the interface standard is developed based on the Linux core. Therefore, this detection method is suitable for most brands and models of routing devices, and can avoid the detection system from running the device and data normally. The influence of the router enhances the response ability of the routing device to the attack behavior, shows good flexibility and universality, and covers the mainstream router attack methods. The experimental verification is carried out. The detection method of the present invention has a higher accuracy rate and success rate. It can remain stable under various types of malicious attacks.

In order to avoid the influence of the long-time running of the program on the forwarding performance of the device, the present invention also adds the function of calculating the running memory space of the network device. Under the condition of ensuring the normal use of the network device, the detection program reduces the impact on it as much as possible. load effect.

Description of drawings

Figure 1 is a schematic diagram of the overall framework of the detection method.

Figure 2 is a schematic diagram of the routing device capturing traffic.

Figure 3 is a schematic diagram of the principle of the detection system.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

Embodiment 1: The present invention analyzes the characteristics of malicious behavior of routing equipment from the perspective of routing equipment status and equipment data processing and forwarding, extracts characteristic attributes that are different from normal behaviors, and summarizes several mainstream malicious behaviors. attack method, and use its characteristics to formulate detection rules, and finally design an intrusion behavior detection system.

The flow of the malicious behavior detection system for weakly supervised routing devices is shown in Figure 3. The malicious behaviors suffered by routing devices are detected and alarmed, and a lightweight detection system is loaded to protect network devices that traditional security methods cannot care about. The system adopts the default calling interface of the routing device operating system, and uses the routing device operating system to monitor the routing device and monitor the data flow.

The detection system includes a device configuration information monitoring module and a device traffic capture module; the device information monitoring module mainly monitors the configuration information of the routing device, and uses the monitor function interface provided by the routing device to write a program hook until the configuration information changes. The state at the time, and the malicious behavior judgment rules are used to determine whether the configuration information has been tampered with.

The device traffic capture module utilizes the capture function in the router IOS system to screen the device transit traffic by setting the IP, port and protocol as parameters, and periodically captures the traffic.

During specific implementation, the detection system includes the following steps:

(1) During the detection period, continuously capture the data traffic of the routing device, and periodically return data to the local;

(2) At the same time, the configuration information of the routing device is monitored. According to the preset judgment rules, when the configuration information changes, it identifies and handles malicious attacks, and transmits the router data traffic when the configuration information changes to the local. Analyze data traffic;

(3) When it is determined that the malicious behavior occurs, the alarm information is fed back to the CLI interface, and the time of the malicious behavior is recorded at the same time, and the data packets in the time period of the malicious behavior are analyzed locally to identify the attack method and take countermeasures against the malicious behavior. control measures.

The method for continuously capturing the data traffic of the routing device in this embodiment includes the following steps: (1) First, connect the traffic monitoring tool to the routing device to capture the data traffic of the routing device, and the traffic monitoring tool is called by the TCL language to the routing device The provided API interface implementation; (2) Open up a ring buffer in the memory of the routing device; (3) Capture the data traffic in a 5-minute cycle and save it to the buffer; (4) Then the data traffic in each cycle is transferred. Save it in PCAP format and send it back to the local. (5) Finally, judge whether to end the detection. If the detection continues, clear the buffer and continue to perform step (3); if the detection ends, close the buffer and the detection ends.

The detection system monitors the routing device configuration information of the routing device, and the detection program monitors the changes of various configurations of the device in real time during the running process, and discriminates the operation behavior of the device when the configuration changes according to the judgment rules of malicious behavior. Whether the operation behavior is an offensive behavior.

The main attacks are as follows:

1) Exhaustive cracking

Exhaustive cracking is a common method of trying to break into a routing device system, where attackers try to use dictionary attacks to try to get into the system with common username-password combinations. This type of attack is very common and is usually not limited to weakly supervised routing devices, with currently commonly used dictionaries on the order of 28G. By recording the transit traffic of the network device, it is possible to find out whether an attacker has guessed the password of the routing device account.

2) Illegal hiding of accounts

Setting hidden accounts is a common control behavior for deep hijacking of routing devices. The working principle is to use the embedded event manager (Embeded Event Manager, EEM) function of the routing system to hijack the triggering process of the routing operation instruction, redirect the output of the execution result, filter and hide the added user information, and set the router. The system hides the purpose of the account.

3) Configuration covert tampering

Configuration covert tampering means that after the attacker controls the routing device, in order to make full use of the device performance to achieve further attacks, the target device needs to be customized and modified to achieve the purpose of the attack. Configuration covert tampering mainly uses the CRON function of the device. By configuring the appropriate CRON string, the routing device is set to execute specific instructions at a specific time point or time period, and the configuration information such as the port, network port, and IP address of the routing device is planned and changed. It is convenient for the attacker to execute the attack behavior within a specific time.

4) Backdoor settings

In order to control the routing device more stably, the attacker usually sets up a backdoor after obtaining the routing control authority. For the sake of versatility, most of them are backdoor programs based on TCL/TBC (TBC is a file encrypted by TCL script as a machine intermediate code). This method actually uses the executable attribute of TCL in the routing device to load malicious scripts through illegally hidden backdoor users to open special ports for monitoring, and attackers can use commands such as telnet/ssh to directly access the backdoor user rights from the special port. Routing device for access and operation.

At the same time, combined with the traffic captured by the detection system in real time, the data packets during the configuration change period are analyzed. Through comprehensive comparison, the specific operation details of the routing device when the configuration changes are analyzed and analyzed. If an operation behavior determined by the detection rule as a malicious attack occurs during the detection process, the attack operation process and the changed configuration attribute information are recorded. According to the time attribute, analyze the data packets in the current time period, check the specific changes of data traffic when the running state of the routing device changes, and alert the device management personnel.

Embodiment 2: This embodiment is basically the same as Embodiment 1, except that this embodiment further defines configuration information and detection rules.

Monitoring the configuration information of the routing device includes configuration monitoring and service monitoring. The configuration monitoring includes account increase or decrease, event planning, task execution and network interface monitoring when the routing device is running; the service monitoring includes port opening, service Monitoring of open conditions and incoming and outgoing traffic.

The determination rules include the following: 1) whether to use an illegal account to modify the configuration of the routing device; 2) whether there is a behavior of closing the system log when modifying the configuration of the routing device; 3) when modifying the configuration of the routing device , whether the time point belongs to the normal time range of the administrator's work; 4) When modifying the configuration of the routing device, whether the IP address of the command data source meets the restrictions of the ACL access control list; 5) When modifying the configuration of the routing device, Are there any situations where the communication channel uses unconventional network protocols or uncommon ports.

Embodiment 3: This embodiment is basically the same as Embodiment 1, and the difference is that the detection system is further described in this embodiment.

The routing device operating system provides the user with a convenient and practical management function interface. The lightweight detection program designed in the present invention uses the TCL industrial control language, adopts the routing device default function interface, and uses the routing device operating system to capture the device attribute state and transit. flow.

The operation process of the detection system is mainly as follows:

1) Upload and deploy the detection system

There are two main ways to run the detection system on the experimental router. The first is to upload the detection system program to the router's flash file directory through FTP, TFTP, etc., and use the command line to execute:

Router(2900)#

Copy tftp://10.114.xxx.xxx/detec.tcl flash;

Router(2900)#tclsh detect.tcl;

The second is to directly transfer the detection program to the memory of the routing device for direct execution, and the program files are not stored on the experimental router:

Router(2900)#

Tclsh tftp://10.114.xxx.xxx/detect.tcl;

2) Monitor the device status and send back the test results

The detection system opens up storage space on the experimental router, stores the processing results of the detection system, and at the same time uses the postback function to transmit the malicious configuration tampering, CRON, and EEM illegal changes back to the local for further analysis.

By analyzing the device traffic and detection results captured by the detection system, the attacker's intent is found. In addition, for these special attack types, the trends or characteristics of different types of attacks suffered by routing devices in a weakly supervised environment can be found.

3) Analyze the detection and attack methods

For the change of the status information of the routing device, it mainly includes the attribute information of the device, such as: port, IP, EEM service, Cron task planning, account password, etc. After passing the rule judgment, check the specific recorded data of the detection system to determine whether there is illegal intrusion behavior.

According to the specific time point of the intrusion behavior, analyze the data traffic of the corresponding time period captured by the detection system, and through the specific analysis of the data traffic, get the specific operation behavior of the attacker at the time point when the malicious behavior occurred. Notifications govern the safe maintenance of equipment.

The invention can better make up for the deficiency of the security protection of routing equipment deployed in small, scattered, remote and edge environments. It provides an easy-to-use intrusion detection solution for the protection of core nodes and large equipment.

Compared with the existing malicious behavior detection methods, the lightweight detection method based on routing devices can support effective security protection for small and medium-sized routing devices with scattered deployment and low security protection.

Embodiment 4, this embodiment adds the function of calculating the runnable memory space of the network device.

In order to avoid the influence of the long-time running of the program on the forwarding performance of the device, the present invention also adds the function of calculating the running memory space of the network device. Under the condition of ensuring the normal use of the network device, the detection program reduces the impact on it as much as possible. load effect.

The specific methods are as follows:

To sum up, the invention has the advantages of low cost, high availability, and high scalability, and can be used for continuous development to deal with subsequent attack threats against routing equipment in a weak supervision environment.

Claims (6)

1. a malicious behavior detection method for weakly supervised routing equipment, is characterized in that: the malicious behavior that routing equipment suffers from is detected and alarmed, and the network equipment that traditional security means cannot be scruples is protected by loading a lightweight detection system, The detection system adopts the default calling interface of the routing device operating system, and uses the routing device operating system to monitor the routing device and monitor data traffic; the detection system includes a device configuration information monitoring module and device traffic capture. module; the device information monitoring module mainly monitors the configuration information of the routing device, uses the monitor function interface provided by the routing device, writes a program hook to the state when the configuration information changes, and cooperates with the malicious behavior judgment rules to determine whether the configuration information is Being tampered with; the device traffic capture module utilizes the capture function in the router IOS system, and sets up traffic filtering rules to screen device transit traffic by using IP, port, and protocol as parameters, and periodically captures traffic; The detection system includes the following steps: (1) During the detection period, continuously capture the data traffic of the routing device, and periodically return data to the local; (2) At the same time, the configuration information of the routing device is monitored. According to the preset judgment rules, when the configuration information changes, it identifies and handles malicious attacks, and transmits the router data traffic when the configuration information changes to the local. Analyze data traffic; (3) When it is determined that the malicious behavior occurs, the alarm information is fed back to the CLI interface, and the time of the malicious behavior is recorded at the same time, and the data packets in the time period of the malicious behavior are analyzed locally to identify the attack method and take countermeasures against the malicious behavior. control measures. 2 . The malicious behavior detection method for weakly supervised routing equipment according to claim 1 , wherein the method for continuously grabbing the data traffic of the routing equipment comprises the following steps: (1) First, connect the flow monitoring tool to the routing equipment pair. 3 . The data traffic of the routing device is captured, and the traffic monitoring tool is implemented by calling the API interface provided by the routing device by the TCL language; (2) Open up a ring buffer in the memory of the routing device; (3) Capture the data in a 5-minute cycle Data traffic, and save it to the buffer; (4) Then dump the data traffic of each cycle into PCAP format and send it back to the local, (5) Finally judge whether to end the detection, if the detection continues, clear the buffer and continue Step (3) is executed; if the detection is over, the buffer is closed, and the detection ends. 3. The malicious behavior detection method for weakly supervised routing equipment according to claim 1, characterized in that: monitoring the configuration information of the routing equipment includes configuration monitoring and service monitoring, and the configuration monitoring includes the routing equipment in a running state. Account increase or decrease, event planning, task execution and network interface monitoring; the service monitoring includes monitoring of port opening, service opening and incoming and outgoing traffic. 4 . The malicious behavior detection method for weakly supervised routing equipment according to claim 3 , wherein the determination rule includes the following contents: 1) whether to use an illegal account to modify the configuration of the routing equipment; 2) when routing Whether the system log is closed when the device configuration is modified; 3) When the routing device configuration modification operation is performed, whether the time point belongs to the normal time range of the administrator's work; 4) When the routing device configuration modification operation is performed, the command data Whether the IP address of the source satisfies the restrictions of the ACL access control list; 5) When modifying the configuration of the routing device, whether there is a situation that the communication channel uses an unconventional network protocol or an uncommon port. 5. the malicious behavior detection method for weakly supervised routing equipment according to claim 1, is characterized in that: Described detection system utilizes TCL industrial control language, the routing equipment default function interface adopted, and adopts following two ways and routing equipment Establish a connection: The first is to upload the detection system program to the router's flash file directory through FTP, TFTP, etc.; the second is to directly transfer the detection program to the memory of the routing device for direct execution, and the program files are not stored on the experimental router. 6 . The malicious behavior detection method for weakly supervised routing devices according to claim 1 , wherein the countermeasures specifically include: 1) for the attack source address, setting an ACL based on IP address, port, and network protocol. 7 . Prevention and control strategy; 2) For illegally opened accounts, notify the administrator to access the device through the serial line to clean up; 3) For the tampered routing device configuration information, roll back and restore to the administrator saved 4) When conditions permit, upgrade the device firmware as soon as possible.

Images