RU2472211C1 - Method of protecting information computer networks from computer attacks - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method involves forming an array for storing fragmented message packets and arrays for storing parameters from the stored message packets; upon detection of a computer attack, stored values of message packets are deleted; the allocated fields used are defined data fields and a list of trusted addresses of a recipient and sender of message packets which are stored in arrays of reference parameters of values of corresponding data fields is created.

EFFECT: faster detection of computer attacks.

6 dwg

Description

The invention relates to telecommunications and can be used in systems of protection against computer attacks by quickly detecting and blocking them in information and computer networks (IVS).

A known method of protection against computer attacks, implemented in RF patent No. 2179738 "Method for detecting remote attacks in a computer network", class G06F 12/14, 04.24.2000.

This method includes the following sequence of actions. Monitoring the information flow of message packets addressed to the IVS subscriber, including continuously renewed counting of the number of packets, performed within a series of packets arriving from the communication channel (CS) one after another at intervals of no more than a specified time. At the same time, the incoming data packets are checked for compliance with the given rules each time the size of the next observed series reaches a critical number of packets.

The disadvantages of this method are: a narrow scope, due to its purpose mainly to protect against the substitution of one of the participants in the connection, and insufficient reliability when detecting other types of computer attacks. In the analogue, a limited set of indicative descriptions of computer attacks is used. At the same time, they do not take into account the presence of a large number of types of computer attacks, in particular, types of attacks that use fragmentation of packets transmitted between segments of the IVS, which creates the conditions for skipping the latter and, as a result, reduces the stability of the functioning of the IVS.

A known method of operational dynamic analysis of the state of a multi-parameter object is described in RF patent 2134897, published on 08.20.1999, which allows detecting computer attacks by changing the state of an IVS element. In the known method, the results of the tolerance assessment of heterogeneous dynamic parameters are converted into corresponding information signals with a generalization over the entire set of parameters in a given time interval and the relative magnitude and nature of the change in the integral state of the multiparameter IVS element is determined.

The disadvantage of this method is the narrow scope, due to the fact that despite the possibility of operational diagnostics of the technical and functional states of the multiparameter element of the IVS, it uses a limited set of attribute space, which creates the conditions for skipping remote computer attacks (see Medvedovsky I.D. and other attack on the Internet. - M.: DMK, 1999. - 336 pp., ill.) and, as a result, leads to a decrease in the stability of the functioning of the IVS.

A known method of protection against computer attacks, implemented in the device according to the patent of the Russian Federation 2219577 "Information retrieval device", class G06F 17/40, published on 04.24.2002. The method consists in taking the i-th packet from the CS, where i = 1, 2, 3, ..., and remember it. Receive the (i + 1) th packet, remember it. Identification signs are extracted from the header of the i-th and (i + 1) -th packets, they are analyzed for consistency, and the decision is made on the fact of a computer attack based on the results of the analysis.

The disadvantage of this method is the relatively low stability of the IVS functioning under the influence of computer attacks, due to the fact that by comparing two message packets - the next and the previous one, only one family of computer attacks is recognized - a “storm” of false requests to establish a connection, while computer attacks of others types with high destructive capabilities are not recognized.

The closest in technical essence to the proposed method is a method of protecting information and computer networks from computer attacks according to patent RU No. 2285287, IPC G06F 12/14, H06F 12/22. Publ. 10/10/2006, bull. No. 28. The method consists in the following actions: take the i-th, where i = 1, 2, 3 ..., the message packet from the communication channel, remember it, receive the (i + 1) th message packet, remember it, extract it from the remembered fragmented message packets the parameters characterizing them calculate the necessary parameters for comparing the received fragmented packets and, based on the results of the comparison, decide on the presence or absence of a computer attack.

The disadvantage of the prototype method is the low efficiency of detecting a computer attack, due to the implementation of appropriate detection actions already in the process of carrying out a computer attack, which can lead to unauthorized exposure to the computer network.

The purpose of the claimed technical solution is to develop a method for protecting information and computer networks from computer attacks, which provides increased detection efficiency of a computer attack on an information and computer network by determining information about the preparation of a computer attack by using trace packet transmission routes along certain trusted routes that enter the information and computer network from communication channels.

In the claimed invention, the goal is achieved by the fact that in the known method, an array is formed for storing fragmented message packets and arrays for storing parameters extracted from stored message packets, receive the next message packet from the communication channel, remember it, analyze the stored packet to detect the presence or the absence of a computer attack, and in the absence of a computer attack, they send the next message packet to the computer network, and if a computer is detected The black attacks make a decision to ban the transmission of the packet to the computer network and delete previously stored values of the message packets from the arrays; in addition, the data fields are used as the selected fields from the stored message packets: “Packet lifetime” {T}, “Options” {О }, "Destination IP address" {D}, "Source IP address" {I}, which are stored in arrays formed for them. Additionally, a list of trusted addresses of the recipient and sender of message packets is formed, which are stored in the arrays of the reference parameters of the data field values: “Destination IP address” {D _floor } and “Source IP address” {I _floor }. Then, the computer network is adapted, for which, in test mode, the values of the data packets of the packet “Lifetime of the packet” and “Options” are measured for all routes between trusted recipients and the sender of message packets. Remember the measured values of the parameters in the corresponding arrays of reference parameters of the data field values "Package lifetime" T _et , "Options" About _et . After storing the received message packet, in order to detect the fact of an attack or its absence, the values of the data fields “Packet lifetime” T, “Options” О, “Destination IP address” D and “Source IP address” I are extracted from the header of this packet and stored in corresponding arrays {T}, {O}, {D} and {I}. The reference values of the data fields “packet lifetime”, “options”, “destination IP address” and “source IP address” are compared with the values of the data fields from the received packet. Moreover, the fact of the absence of an attack is established if the reference values of the data fields “Packet lifetime”, “Options”, “Destination IP address” and “Source IP address” coincide with the values of the data fields from the received packet, and the fact of an attack is established if the reference values the data fields “Package lifetime”, “Options”, “Destination IP address” and “Source IP address” do not match the data field values from the received packet.

A new set of essential features allows to achieve the specified technical result by determining information about the preparation of a computer attack by using the trace of packet transmission routes along certain trusted routes entering the computer network from communication channels.

The claimed method is illustrated by drawings, which depict the following:

figure 1 is a block diagram of the algorithm "method of protecting the ITT from computer attacks";

figure 2 is a diagram explaining the formation of the route of transmission of message packets in the IVS;

figure 3 - header IP datagram;

figure 4 - the value of the data field "Options" package after passing through the communication network;

figure 5 is a table of reference values of the data fields "Destination IP address", "Source IP address", "Packet lifetime" and "Options";

figure 6 - dependence of the detection time of a computer attack on the volume of the fragmented message.

The implementation of the claimed method is illustrated by the algorithm (figure 1), the circuit (figure 2) and is explained as follows.

1. An array P is formed for storing IP message packets coming from the communication channel.

2. Arrays D, I, T and O are formed for storing parameters selected from stored message packets, respectively:

D - for storing the values of the data field "Destination IP address";

I - for storing the values of the data field "IP address of the source";

T - to remember the values of the data field "lifetime of the packet";

О - for storing the values of the “Options” data field.

In the present invention use the functions of the IP protocol used in the transmission of packets over the network. The IP header contains many fields (FIG. 3). In the fields “Destination IP Address” and “Source IP Address” there will be 32-bit sequences defining the logical addresses of the destination and the source of the message packet necessary for transmitting it via the IVS.

Field "packet lifetime" defines the maximum lifetime of the datagram in the network.

The Options field is optional and has a variable length. Support for options should be implemented in all IP modules (nodes and routers). The standard defines 8 options. In the present invention, the option “route recording” is used [RFC 791, Internet Protocol, 1981, September, pp. 14-22].

3. Arrays D _et , I _{et are formed} to store the reference parameters extracted from the stored message packets:

D _et - values of the data field "Destination IP address";

I _et - values of the data field "Source IP Address".

4. Arrays of T _et , O _{et are formed} to store the reference parameters extracted from the stored message packets:

T _et - values of the data field "lifetime of the packet";

About _et - values of the "Options" data field.

5. Determine the trusted IP addresses of the receiver and sender to store these values in an array of D _et , I _et . Trusted IP addresses mean pairs of addresses, source and destination, legitimate subscribers of various fragments of the IVS. The values of trusted addresses of the recipient and sender of message packets are stored in an array D _et , I _et .

6. Adapt the computer network. Adaptation refers to the operation of an information-computer network in test mode for implementation in specific operating conditions [GOST R 53622-2009 “Information technology. Information computing systems. Stages and stages of the life cycle, types and completeness of documents ”, p.4-5].

7. Measure the real values of the data fields of the packet "Lifetime of the packet" and "Options" for the route between the jth pair of trusted addresses of the recipient and sender of message packets, where j = 1, 2, ... N, N is the number of pairs of addresses of trusted subscribers. When packets are transmitted over a network, intermediate nodes (routers) route them using the address information in the packet header [GOST R ISO / IEC 7498-1-99 “Information technology. Interconnection of open systems. The basic reference model. Part 1. The basic model ”, p.13]. Thus, after the packet is transmitted over the network from the source to the recipient of the message, along a specific route, the source and destination addresses (fields “Destination IP address”, “Source IP address”), the number of routers passed (field “packet lifetime”) and route packet passing (field "options") will have the same values for all message packets passing along this route (figure 4). These values are stored in arrays D _et , I _et , T _et , About _et . This procedure is repeated for all pairs of trusted addresses (j = N).

8. After all the reference values of the checked parameters are collected and recorded in the corresponding arrays, the information computer network is transferred to the real mode of operation (operation).

9. Receive the i-th message packet from the communication channel, where i = 1, 2, 3, ....

10. The i-th message packet is stored in the P array for further work with the header of the i-th packet.

11. From the header of the i-th packet, the values of the data field “Packet lifetime” T _i , the data field “Options” O _i , the data field “Destination IP address” D _i and the data field “Source IP address” I _{i are extracted} .

12. Remember in the arrays T, O, D, I the values of the data field “Packet lifetime” T _i , the data field “Options” O _i , the data field “Destination IP address” D _i and the data field “Source IP address” I _i

13. To identify and block computer attacks, search the arrays D _et , I _{et for the} corresponding values of the data fields “Destination IP address” D _i and “Source IP address” I _{i of the} received i-th packet. When these fields coincide, check the correspondence of the values of the data fields "Packet lifetime" T _i and "Options" O _{i of the} received message packet with the reference values of T _et , O _et (Fig. 5).

14. The i-th message packet is transmitted to the computer network when the reference values of the data fields “Packet lifetime”, “Options”, “Destination IP address” and “Source IP address” coincide with the values of the data fields from the received packet.

15. Decide on preparing an attack if the reference values of the data fields “packet lifetime”, “options”, “destination IP address” and “source IP address” with the values of the data fields from the received packet do not match and prohibit the transmission of the ith message packet to computer network, as well as delete all the values from the arrays T, O, D, I.

16. Repeat the steps from receiving the next message packet from the communication channel to comparing the reference values of the data fields with the data fields of the newly received message packet and then decide on the presence or absence of a computer attack.

The feasibility of implementing the formulated technical result was verified by machine simulation. Using modeling, the relationship between the recognition time t _obn (detection) of a computer attack and the fragmented message volume V _message (Fig. 6) was _obtained for a small file size of 0.11 MB, an average file size of 9.96 MB and a large file size of 1452 , 70 MB, taking into account the fact that the volume of the IP packet is 64 Kb. [Give two! Updated hard drive testing / V.Kosikhin // 3DNews magazine, 2011. Access mode: http://www.3dnews.ru/].

The achievement of the technical result is illustrated as follows. For the prototype method, when a computer attack is detected, fragmented packets are detected in time T ₁ , which depends on the volume of the transmitted message. For the proposed method, the detection of a computer attack is made according to the results of the analysis of each sequentially received packet for a time T ₂ without waiting for the time required to defragment the entire message.

In this case, the difference in the required time for detecting a computer attack ΔT = T ₁ -T ₂ the greater, the greater the volume of the fragmented message, which is achieved by the formulated technical result when implementing the claimed method, i.e. increasing the efficiency of detecting computer attacks on the computer network.

Claims (1)

A method of protecting information and computer networks from computer attacks, which consists in forming an array for storing fragmented message packets and arrays for storing parameters extracted from stored message packets, receiving the next message packet from the communication channel, storing it, and analyzing the stored packet for detection the fact of the presence or absence of a computer attack and in the absence of a computer attack send another message packet to the computer network, and if Computer attack phenomena make a decision to prohibit packet transmission to the computer network and delete previously stored values of message packets from arrays, characterized in that the data fields are used as selected fields from stored message packets: "Packet lifetime" {T}, " Options "{О}," Destination IP address "{D}," Source IP address "{I}, which are stored in arrays formed for them, additionally form a list of trusted addresses of the recipient and sender of message packets that are stored in the array x reference parameter data field values: «IP destination address» {D _fl} and «IP source address» {I _fl}, then adapted information-area network, which in a test mode measured values of data fields package "The lifetime of the package" and “Options” for all routes between trusted recipients and the sender of message packets, store the measured parameter values in the corresponding arrays of reference parameters of data field values: “Packet lifetime” T _et , “Options” About _et , after storing the received message packet, for detecting the fact of an attack or its absence, select the values of the data fields from the header of this packet: “Packet lifetime” T, “Options” О, “Destination IP address” D and “Source IP address” I and store them in the corresponding arrays {T}, {О}, {D} and {I}, compare the reference values of the data fields "Packet lifetime", "Options", "Destination IP address" and "Source IP address" with the values of the data fields from the received packet, and establish the fact of absence attacks if the reference values of the data fields are: “Packet lifetime”, “Options”, “Destination IP address” and “IP source address "match the values of the data fields from the received packet, and the fact of an attack is established if the reference values of the data fields:" Packet lifetime "," Options "," destination IP address "and" source IP address "do not match the values of the fields data from the received packet.

Images