RU2013134440A

RU2013134440A - METHOD FOR DETECTING COMPUTER ATTACKS ON A NETWORK COMPUTER SYSTEM

Info

Publication number: RU2013134440A
Application number: RU2013134440/08A
Authority: RU
Inventors: Роза Равильевна Фаткиева; Алексей Юрьевич Атисков; Дмитрий Константинович Левоневский
Original assignee: Открытое Акционерное Общество "Информационные Технологии И Коммуникационные Системы"
Priority date: 2013-07-24
Filing date: 2013-07-24
Publication date: 2015-01-27
Also published as: RU2538292C1

Abstract

Способ обнаружения компьютерных атак на сетевую компьютерную систему, включающую, по крайней мере, один компьютер, подключенный к сети и имеющийустановленную операционную систему;установленное прикладное программное обеспечение, включающее систему анализа трафика, которая выполнена с возможностьюприема из сети и запоминания пакетов сообщений;определения характеристик пакетов сообщений;проведения расчетов для пакетов сообщений и их характеристик;формирования сигналов о наличии атаки по результатам расчетов; способ, заключающийся в том, чтоустанавливают и запоминают пороговые значения параметров, причем в качестве параметров, рассчитываемых в единицу времени, выбираются следующие:R=V/V,где V- объем входящего трафика, принятого по протоколу IP;V- объем исходящего трафика, отправленного по протоколу IP;N- количество потоков критических приложений;D=|N-N|,где N- количество исходящих ACK-флагов в TCP-трафике;N- количество входящих ACK-флагов в TCP-трафике;R=V/V,где V- объем входящего UDP-трафика;V- объем входящего TCP-трафика;R=N/N,где N- количество входящих UDP-пакетов;N- количество входящих TCP-пакетов;R=V/V,где V- объем входящего трафика, полученного по протоколу ICMP;R=N/N,где N- количество SYN-флагов во входящих пакетах, переданных по протоколу TCP;N- количество PSH-флагов во входящих пакетах, переданных по протоколу TCP;R=N/(N-N),L=V/N,где N- количество входящих пакетов, передаваемых по протоколу IP;L=V/N;принимают из сети последовательность пакетов сообщений;запоминают принятые пакеты сообщений;выделяют из запомненных пакетов сообщений характеризующие их данные;рассчитывают значения параметров, зависящих от полученных пакетов сообщений;сравнивают рас�A method for detecting computer attacks on a network computer system including at least one computer connected to a network and having an installed operating system; installed application software including a traffic analysis system that is configured to receive and store message packets from the network; determine packet characteristics messages; carrying out calculations for message packets and their characteristics; generating signals about the presence of an attack according to the results of calculations; the method is that the threshold values of the parameters are set and stored, and the following are selected as parameters calculated per unit time: R = V / V, where V is the amount of incoming traffic received over IP, V is the amount of outgoing traffic, sent over IP; N is the number of critical application flows; D = | NN |, where N is the number of outgoing ACK flags in TCP traffic; N is the number of incoming ACK flags in TCP traffic; R = V / V, where V is the amount of incoming UDP traffic; V is the amount of incoming TCP traffic; R = N / N, where N is the number of incoming UDP packets; N is the number the number of incoming TCP packets; R = V / V, where V is the amount of incoming traffic received via ICMP; R = N / N, where N is the number of SYN flags in incoming packets transmitted via TCP; N is the number of PSH - flags in incoming packets transmitted over TCP; R = N / (NN), L = V / N, where N is the number of incoming packets transmitted over IP; L = V / N; receive a sequence of message packets from the network; remember received message packets; extract data characterizing their messages from stored message packets; calculate values of parameters depending on received packets from bscheny; comparing races

Claims

A method for detecting computer attacks on a network computer system comprising at least one computer connected to a network and having

installed operating system;

installed application software including a traffic analysis system that is configured to

receiving from the network and storing message packets;

characterization of message packets;

calculations for message packets and their characteristics;

generating signals about the presence of an attack based on the results of calculations; the method is that

threshold parameters are set and stored, and the following are selected as parameters calculated per unit time:

R _IP = V _IN / V _OUT ,

where V _IN is the amount of incoming traffic received over IP;

V _OUT - the amount of outgoing traffic sent over IP;

N _CR is the number of threads of critical applications;

D _ACK = | N _OUT -N _IN |,

where N _OUT is the number of outgoing ACK flags in TCP traffic;

N _IN - the number of incoming ACK flags in TCP traffic;

R _UDP = V _UDP / V _TCP ,

where V _UDP is the amount of incoming UDP traffic;

V _TCP - the amount of incoming TCP traffic;

R _NUD = N _UDP / N _TCP ,

where N _UDP is the number of incoming UDP packets;

N _TCP - the number of incoming TCP packets;

R _ICM = V _ICM / V _IN ,

where V _ICM is the amount of incoming traffic received via ICMP;

R _SP = N _SYN / N _PSH ,

where N _SYN is the number of SYN flags in incoming packets transmitted over TCP;

N _PSH - the number of PSH flags in incoming packets transmitted over TCP;

R _TCP = N _PSH / (N _TCP -N _PSH ),

L _AVG = V _IN / N _IP ,

where N _IP - the number of incoming packets transmitted over IP;

L _TCP = V _TCP / N _TCP ;

receive a sequence of message packets from the network;

remember the received message packets;

extracting data characterizing their stored message packets;

calculate the values of the parameters depending on the received message packets;

comparing the calculated parameter values with threshold values;

decide on the presence or absence of a computer attack when comparing the calculated parameter values with threshold values;

determine the type of a single computer attack by a combination of calculated parameter values based on the following conditions,

if the values of the parameters R _IP and N _CR exceeded the threshold value, an attack of the HTTP flood type is determined (condition 1);

if the values of the parameters R _IP , D _ACK, and R _SP exceeded the threshold value, and R _TCP and L _{TCP are} less than the threshold value, then an SYN-flood attack is determined (condition 2);

if the values of the parameters R _IP , R _TCP, and D _{ACK have} exceeded the threshold value, an attack of the TCP-flood type is determined (condition 3);

if the values of the parameters R _IP , R _UDP, and R _NUD exceeded the threshold value, then an attack of the UDP-flood type is determined (condition 4);

if the values of the parameters R _IP and R _{ICM have} exceeded the threshold value, and L _{AVG is} less than the threshold value, then an ICMP flood attack is determined (condition 5);

determine a combined computer attack by a combination of calculated parameter values based on the following conditions:

if condition 1 and condition 2 are fulfilled at the same time, then a combined HTTP-flood and SYN-flood attack is determined;

if condition 1 and condition 3 are fulfilled at the same time, then a combined HTTP-flood and TCP-flood attack is determined;

if condition 1 and condition 5 are fulfilled simultaneously, then a combined HTTP-flood and ICMP-flood attack is determined;

if condition 2 and condition 5 are simultaneously fulfilled, then a combined SYN-flood and ICMP-flood attack is determined;

if condition 3 and condition 5 are simultaneously fulfilled, then a combined TCP-flood and ICMP-flood attack is determined.