RU2745004C1 - Method for protecting computing networks - Google Patents

Abstract

FIELD: computing.SUBSTANCE: method for protecting computer networks is intended for use in intrusion detection systems for the purpose of promptly countering unauthorized influences in computer data transmission networks based on the TCP / IP family of communication protocols.EFFECT: technical result is achieved by dividing the response to the attacker into fragments and sending these fragments through numerous small time intervals, as well as sending them deliberately fake messages about a temporary or permanent impossibility of continuing the postal transaction. The technical result is also increased protection effectiveness.6 cl, 6 dwg

Description

The invention relates to telecommunications and can be used in intrusion detection systems for the purpose of prompt detection and counteraction of unauthorized influences in computer networks, in particular, in a data transmission network of the "Internet" type, based on the family of communication protocols TCP / IP (Transmission Control Protocol / Internet Protocol).

A known method of protecting computer networks "System for analyzing data transfer protocols in order to neutralize programs that send spam" according to RF patent No. 101234, class G06F 21/00, G06F 11/00, Appl. 23.07.2010. The known method includes the following sequence of actions. Reputation rules are set and recorded in the database, which determine that the client is a spambot. A request from clients to the server is received and the protocol of data transfer between the client and the server, the presence of protocol errors, the number of requests from clients to the server, and client addresses are determined. Exhibit reputation to clients from whom requests were received in accordance with the used reputation rules. If a spam bot is identified that uses a spam-sending program, means of disinfecting the program sending spam are sent to the addresses of spambots from which requests are sent to the server.

The disadvantage of this method is the relatively low effectiveness of protection, which is due to the lack of accounting for the attacker's ability to block and redirect the remedies forwarded to him for the treatment of a program that sends spam, as well as the lack of accounting for the attacker's ability to send spam from fake email addresses, which increases the likelihood of successful implementation of some types of NDR (Non Delivery Report) attacks based on the return of mail messages to the sender, the recipient of which does not exist. In addition, another drawback that significantly affects the effectiveness of the method under consideration is the compromise of the applied protection means, which forces the attacker to continue the harmful effect and (or) change his strategy.

A known method of protecting computer networks "Preventing unauthorized mass mailing of e-mail" according to RF patent No. 2472308, class H04W 4/12, G06F 15/167, Appl. May 19, 2011. The known method includes the following sequence of actions. Messages filtered on the mail server, recognized as a virus and spam, are not only marked, moved to another mailbox or deleted, but copies of such messages are returned to the sender, due to which his mailbox becomes full and blocked, and the sending of unauthorized bulk e-mail from this address is stopped ... Mailboxes on e-mail servers are configured to block when overflowed, interrupting the sending of emails.

The disadvantage of this method is the relatively low efficiency and narrow scope. The narrow scope is due to the application of a method to counter an attacker who uses only one mailbox for mass spam mailing at a time, do not take into account the possibility of using for this purpose by an attacker many mailboxes of different computers, under the control of spambots, which dramatically increase his capabilities. Poor protection performance is due to the blocking of mailboxes of e-mail servers, when they are overflowed due to intensive exchange of e-mail messages with an attacker, which will lead to a decrease in the speed or impossibility of information exchange of e-mail messages with authorized senders (denial of service). In addition, the lack of accounting for the attacker's ability to block and redirect spam messages sent back to him, as well as the lack of accounting for the attacker's ability to send bulk spam from fake email addresses increases the likelihood of successful implementation of some NDR attacks (Non-Delivery Report) based on on non-delivery of e-mail, such as "bounce message attack", "bounce-source" or "backscatter-attack", known and described, for example, in the article by Kaspersky K. Unlimited spam // Hacker, No. 07 (103), June 2007, on pp. 48-51 and will lead to regression (degradation) of the basic quality of the prototype method. Another drawback that significantly affects the effectiveness of the method under consideration is that the implementation of the specified approach to protection compromises the applied protection means and forces the attacker to continue the harmful effect and (or) change his strategy.

The closest in technical essence to the claimed is a method of protecting computer networks "Response delay management using connection information" according to US patent No. 70220600 A1, class G06F 2/4 (2006.01), publ. 20.09.2007. The method consists in performing the following actions: N≥1 reference identifiers of authorized senders and recipients of e-mail messages are preset. Establish a network connection with the sender of the e-mail messages. A command is received from the sender that identifies the sender of the mail messages, the identifiers of the sender of the mail messages are extracted and compared with the reference identifiers of the authorized senders and recipients of the e-mail messages. If they match, a response is sent about the readiness of the recipient for the next stage of the mail transaction to the sender of the messages. Otherwise, the transmission rate of the generated response is reduced for the time t _back and the generated response is sent to the sender after the time t _back with a decrease in the transmission rate. In the case of receipt from the sender of the e-mail the team at the end of a network connection, before the expiry of the time t _ass sending a reply response, break the network connection to the sender of e-mail messages. Further, at each of the stages of the mail transaction, the cycle of receiving commands from the sender identifying the sender and recipients of mail messages, highlighting the identifiers of the sender and recipients of mail messages, comparing them with the reference identifiers of authorized senders and recipients of e-mail messages, breaking the connection with the sender in case of receiving commands from him to complete connections before the expiration of time t _backside sending a reply response. Increase the value of time delay t _butt that sends a response back to the sender e-mail in the case of repeated attempts to send messages unauthorized sender.

The known prototype method provides a higher protection efficiency in comparison with analogs due to the delay for a given time in response responses to the attacker's commands during the transmission of e-mail messages, which makes it possible to reduce the number of unwanted messages sent to them and, thereby, to reduce and (or) stop malicious impact of an intruder.

The disadvantage of the prototype method is the relatively low effectiveness of protection, which is due to the fact that the time delay in sending response responses to the attacker's commands, after his identification in the process of sending e-mail messages via the SMTP protocol, is carried out after a sufficiently long delay time t _back , the value of which increase in case of its repeated attempts to transmit e-mail messages. This can lead to the compromise of the applied protection means, which forces the attacker to further influence the computer networks and (or) change the applied strategy of influence, as well as bypass the applied protection means when the attacker sets sufficiently short timeouts for waiting for responses from the message recipient at various stages. the process of sending e-mail messages using the SMTP protocol.

The aim of the claimed technical solution is to develop a method for protecting computer networks, which ensures an increase in the effectiveness of protection by reducing the possibility of an attacker detecting the fact of using protection means, achieved by simulating a communication channel with poor quality at various stages of a mail transaction, by splitting the response to the attacker into fragments and directions of these fragments at multiple short delay intervals, forwarding a response to the attacker after multiple intermediate responses sent at multiple short delay intervals, and sending deliberately false messages to the attacker about the temporary or permanent impossibility of continuing the mail transaction.

счетчик сформированных промежуточных откликов, хранящихся в массиве памяти V. После этого задают массив памяти J для хранения матрицы соответствия d-му промежуточному отклику из массива V t-го сформированного значения времени задержки его направления отправителю сообщений электронной почты из массива памяти L. После этого задают массив памяти P для хранения g фрагментов, на которые разделяют ответный отклик, направляемый отправителю сообщений, где g=1, 2, …, G, a G - общее количество сформированных фрагментов, на которые разделяют ответный отклик, направляемый отправителю сообщений. Затем задают массив памяти Z для хранения ƒ сформированных значений времени задержки передачи фрагментов ответного отклика отправителю сообщений электронной почты, где ƒ=1, 2, …, F, a F - общее количество сформированных значений времени задержки направления фрагментов ответного отклика отправителю сообщений электронной почты. Далее задают счетчик m сформированных фрагментов, на которые разделяют ответный отклик, хранящихся в массиве памяти Р. После этого задают массив памяти Н для хранения матрицы соответствия g-му фрагменту из массива Р ƒ-го сформированного значения времени его задержки из массива памяти Z. Далее задают массив памяти X для хранения и ответных откликов на команды отправителя сообщений, содержащих коды ошибки в соответствии со спецификацией протокола SMTP, где u=1, 2, … U, a U - общее количество ответных откликов на команды отправителя сообщений, содержащих коды ошибки. Затем, если после приема идентифицирующей отправителя команды, выделения идентификаторов отправителя и их сравнения с опорными, выделенные идентификаторы не соответствуют опорным идентификаторам санкционированных отправителей сообщений из массива памяти М, то формируют R промежуточных откликов, которые будут направлены отправителю сообщений электронной почты перед ответным откликом. После этого запоминают R промежуточных откликов в массиве памяти V и устанавливают значение счетчика

сформированных промежуточных откликов, хранящихся в массиве памяти V равным R. Далее формируют Т значений времени задержки промежуточных откликов отправителю сообщений и запоминают Т значений времени задержки промежуточных откликов отправителю сообщений в массиве памяти L. После этого запоминают в массиве памяти J соответствие d-му промежуточному отклику из массива V t-го сформированного значения времени его задержки из массива памяти L. Затем считывают из массива памяти J первый из R сформированных промежуточных откликов и из массива памяти L первое из Т сформированных значений времени задержки. Далее направляют отправителю сообщений первый из R сформированных промежуточных откликов через первое из Т сформированных значений времени задержки. После этого удаляют первый из R сформированных промежуточных откликов и первое из Т сформированных значений времени задержки, а также запись об их соответствии из массивов памяти V, L и J соответственно. Затем уменьшают значение счетчика

сформированных промежуточных откликов, хранящихся в массиве памяти V на единицу. В случае получения после отправки промежуточного отклика команды на завершение сетевого соединения от отправителя сообщений электронной почты значения I_c и I_s уменьшаются на единицу, а сетевое соединение с отправителем сообщений завершается. В ином случае, если, после отправки промежуточного отклика, команды на завершение сетевого соединения от отправителя сообщений электронной почты не последовало, то считывают значение счетчика

сформированных промежуточных откликов. Далее, в случае, если значение счетчика

что говорит о том, что еще не все промежуточные отклики направлены отправителю сообщений электронной почты, то считывают очередной (d+l)-й из ранее сформированных R промежуточных откликов. После этого направляют очередной (d+1)-й из ранее сформированных R промежуточных откликов через (t+1)-e значение времени задержки отправителю сообщений электронной почты, и так до тех пор, пока не будет выполнено условие

означающее, что все промежуточные отклики направлены отправителю. Затем после выполнения условия

направляют ответный отклик отправителю сообщений электронной почты. В случае если после приема от отправителя сообщений команды на начало почтовой транзакции, выделения идентификаторов отправителя, их сравнения с опорными идентификаторами, по результатам сравнения выделенные идентификаторы не соответствуют опорным идентификаторам санкционированных отправителей сообщений из массива памяти М, то формируют G фрагментов, на которые разделяют ответный отклик, направляемый отправителю сообщений. После этого запоминают G фрагментов, на которые разделяют ответный отклик, направляемый отправителю сообщений, в массиве памяти Р. Далее устанавливают значение счетчика т сформированных фрагментов, на которые разделяют ответный отклик, хранящихся в массиве памяти Р, равным G. Затем формируют F значений времени задержки для каждого из фрагментов, на которые разделяют ответный отклик отправителю. После этого запоминают F значений времени задержки для каждого из фрагментов, на которые разделяют ответный отклик отправителю в массиве памяти Z и запоминают в массиве памяти Н соответствия g-му фрагменту из массива Р ƒ-го сформированного значения времени его задержки из массива памяти Z. Далее считывают из массива памяти Р первый из G сформированных фрагментов ответного отклика и из массива памяти Z первое из F сформированных значений времени задержки. Затем направляют отправителю сообщений первый из G фрагментов ответного отклика через первое из Z сформированных значений времени задержки. После этого удаляют первый из G сформированных фрагментов ответного отклика и первое из F сформированных значений времени задержки, а также запись об их соответствии из массивов памяти Р, Z и Н соответственно. Далее уменьшают значение счетчика т сформированных фрагментов ответного отклика, хранящихся в массиве памяти Р, на единицу. В случае получения после отправки фрагмента ответного отклика команды на завершение сетевого соединения от отправителя сообщений электронной почты значения I_c и I_s уменьшаются на единицу, а сетевое соединение с отправителем сообщений завершается. В ином случае, если после отправки очередного фрагмента ответного отклика команды на завершение сетевого соединения от отправителя сообщений электронной почты не последовало, то считывают значение счетчика m сформированных фрагментов ответного отклика. В случае, если значение счетчика m≠0, что говорит о том, что еще не все фрагменты ответного отклика направлены отправителю сообщений электронной почты, то считывают очередной (g+1)-й из ранее сформированных G фрагментов ответного отклика. Далее направляют очередной (g+lj-й из ранее сформированных G фрагментов ответного отклика через (ƒ+1)-e значение времени задержки отправителю сообщений электронной почты, и так до тех пор пока не будет выполнено условие m=0, означающее, что все фрагменты ответного отклика направлены отправителю. В случае если после приема от отправителя сообщений команды, идентифицирующей получателей сообщений, выделения идентификаторов получателей сообщений, их сравнения с опорными идентификаторами выделенные идентификаторы по результатам сравнения не соответствуют опорным идентификаторам санкционированных получателей сообщений из массива памяти М, то формируют U ответных откликов на команды отправителя сообщений, содержащих коды ошибки в соответствии со спецификацией протокола SMTP. После этого запоминают U ответных откликов в массиве памяти X и считывают из X u-й ответный отклик, содержащий код ошибки, на команду отправителя сообщений электронной почты. Далее направляют отправителю сообщений электронной почты ответный отклик, содержащий код ошибки. В случае неполучения повторной команды от отправителя сообщений по истечении времени тайм-аута ожидания на полученный отклик с кодом ошибки или получения команды о разрыве установленного соединения, значения I_c и I_s уменьшаются на единицу, а сетевое соединение с отправителем сообщений завершается.This goal is achieved by the fact that in the known method for protecting computer networks, N≥1 reference identifiers of authorized senders and recipients of e-mail messages are preset. Next, set I _{c a} counter of the number of connections of the sender of messages and I _{cmax the} maximum possible number of connections of the sender of e-mail messages. Thereafter define _butt t delay time after which a response is transmitted back to the sender of electronic mail messages and an array of memory M for storing reference identifiers authorized senders email messages. Then set the I _s counter of the total number of connections of all senders of e-mail messages and I _{smax the} maximum possible number of connections of all senders of e-mail messages. Next, a network connection is established with the sender of mail messages and a response is sent to the sender, initiating the beginning of an SMTP session from the recipient's side. After that, the value I _{c of the} counter of the number of connections from the message sender is increased by one. Then increase a counter value I _s of the total number of connections to all senders and comparing the counter value I _s the number of connections from all senders from I _smax maximum possible number of connections all senders. When the condition I _s ≥I smax is _satisfied , the values of I _c and I _{s are} reduced by one. Then, the network connection with the sender of the mail messages is terminated. Otherwise, if the condition I _s ≥I _{smax is} not met, a command is received that initiates the sender of mail messages and identifies him. Next, the message sender identifiers are extracted from the received command and the allocated message sender identifiers are compared with the reference identifiers from the memory array M. If, according to the comparison results, the selected identifiers correspond to the reference identifiers of authorized message senders from the memory array M, then a response is sent to the sender of messages about readiness for a mail transaction ... Otherwise, if, according to the comparison results, the allocated identifiers do not correspond to the reference identifiers of the authorized senders of messages from the memory array M, then a response is generated. After that set t _back the delay time of transmission of the generated response response. Then, after time t is sent _back response generated by the response to the sender. If received, at time t _back before sending the response, the commands to terminate the network connection from the sender of the e-mail messages decrease the values of I _c and I _s by one. After that, a network connection with the sender of mail messages is set up. Otherwise, if at time t _back before sending a response response, there is no command to terminate the network connection from the sender of e-mail messages, then a response response is sent to the sender. Next, a command is received from the sender of the messages to start a mail transaction that identifies the sender of the e-mail messages. After that, the message sender identifiers are extracted from the received command and the selected message sender identifiers are compared with the reference identifiers from the memory array M. If, according to the comparison results, the selected identifiers correspond to the reference identifiers of authorized message senders from the memory array M, then a response is sent to the sender of messages about the receipt of the received command and the beginning of a postal transaction. Otherwise, if, according to the comparison results, the allocated identifiers do not correspond to the reference identifiers of the authorized senders of messages from the memory array M, then a response is generated. Then set t _back the delay time for transmitting the generated response response. Then, after the expiration of time t _back , the generated response is sent to the sender. If received, at time t _back before sending the response, the commands to terminate the network connection from the sender of the e-mail messages decrease the values of I _c and I _s by one. After that, the network connection with the sender of the mail messages is terminated. Otherwise, if at time t _back before sending a response response, there is no command to terminate the network connection from the sender of e-mail messages, then a response response is sent to the sender. A command is then received from the sender of the messages, indicating the recipients of the e-mail message. After that, the value of I is compared _{with the} counter of the number of connections of the message sender I _{cmax with the} maximum possible number of connections of the message sender. Further, when the condition I _c ≥I cmax is _satisfied , the values of I _c and I _{s are} decreased by one and the network connection with the sender of mail messages is terminated. Otherwise, if the condition I _c ≥I _{cmax is} not met, a command is received indicating the recipients of the e-mail message and the identifiers of the message recipients are extracted from the received command. Then the allocated identifiers of message recipients are compared with the reference identifiers from the memory array M. If, according to the results of the comparison, the allocated identifiers correspond to the reference identifiers of the authorized recipients of messages from the memory array M, then a response is sent to the sender of messages about the readiness to continue the mail transaction. Otherwise, if, according to the comparison results, the allocated identifiers do not correspond to the reference identifiers of the authorized recipients of messages from the memory array M, then a response is generated. Next, set t _back the delay time for transmitting the generated response response, and after the time t _back, send the generated response response to the sender. If received, at time t _back before sending the response, the commands to terminate the network connection from the sender of the e-mail messages decrease the values of I _c and I _s by one. After that, the network connection with the sender of the mail messages is terminated. Otherwise, if at time t _back before sending a response response, there is no command to terminate the network connection from the sender of e-mail messages, then a response response is sent to the sender. Next, they receive the next command that initiates the transmission of mail data and send the sender of the messages a response response about the readiness to receive the text of the e-mail message. The body of the e-mail is then received and the mail transaction is completed by sending a response confirming the transaction. After that, the values of I _c and I _{s are} decreased by one and the network connection with the sender of mail messages is terminated. In the preset data, the memory array L is additionally set for storing t generated values of the delay time of intermediate responses to the sender of e-mail messages, where t = 1, 2, ..., T, and T is the total number of generated values of the delay time of intermediate responses to the sender of messages. Then, a memory array V is specified to store d intermediate responses to the sender of the email messages, where d = 1, 2 ... R, and R is the total number of intermediate responses that will be sent to the sender of the email messages before the reply message. Next, set

the counter of the generated intermediate responses stored in the memory array V. After that, the memory array J is set to store the correspondence matrix for the d-th intermediate response from the array V of the t-th generated value of the delay time for sending it to the sender of e-mail messages from the memory array L. After that, set memory array P for storing g fragments into which the response response sent to the message sender is divided, where g = 1, 2, ..., G, and G is the total number of formed fragments into which the response response sent to the message sender is divided. Then, a memory array Z is set to store ƒ the generated values of the delay time for the transmission of response fragments to the sender of e-mail messages, where ƒ = 1, 2, ..., F, and F is the total number of generated values of the delay time for sending response fragments to the sender of e-mail messages. Next, a counter of m formed fragments is set, into which the response is divided, stored in the memory array P. After that, the memory array H is set to store the matrix of correspondence to the g-th fragment from the P-th generated value of its delay time from the memory array Z. Further specify an array of memory X for storing and responding to commands from the sender of messages containing error codes in accordance with the specification of the SMTP protocol, where u = 1, 2,… U, and U is the total number of responses to commands from the sender of messages containing error codes. Then, if, after receiving the command identifying the sender, allocating the sender identifiers and comparing them with the reference ones, the allocated identifiers do not correspond to the reference identifiers of authorized senders of messages from the memory array M, then R intermediate responses are generated that will be sent to the sender of e-mail messages before the response response. After that, R intermediate responses are stored in the memory array V and the counter value is set

generated intermediate responses stored in the memory array V equal to R. Next, T values of the delay time of intermediate responses to the message sender are formed and T values of the delay time of intermediate responses to the message sender are stored in the memory array L. After that, the correspondence to the d-th intermediate response is stored in the memory array J from the array V of the t-th generated value of its delay time from the memory array L. Then the first of the R generated intermediate responses is read from the memory array J and the first of the T generated delay time values from the memory array L. Next, the first of the R generated intermediate responses is sent to the message sender through the first of the T generated delay time values. After that, the first of the R generated intermediate responses and the first of the T generated delay time values are removed, as well as a record of their correspondence from the memory arrays V, L and J, respectively. Then decrement the value of the counter

generated intermediate responses stored in the memory array V per unit. If, after sending an intermediate response, a command to terminate the network connection from the sender of the e-mail messages is received, the values of I _c and I _{s are} decreased by one, and the network connection with the sender of the messages is terminated. Otherwise, if, after sending an intermediate response, there is no command to end the network connection from the sender of e-mail messages, then the counter value is read

generated intermediate responses. Further, if the value of the counter

which means that not all intermediate responses have been sent to the sender of e-mail messages, then the next (d + l) -th of the previously generated R intermediate responses is read. After that, the next (d + 1) th of the previously generated R intermediate responses is sent through the (t + 1) -e value of the delay time to the sender of the e-mail messages, and so on until the condition is met

meaning that all intermediate replies are sent to the sender. Then after fulfilling the condition

send a response to the sender of the e-mail messages. If, after receiving a command from the sender at the beginning of a mail transaction, allocating sender identifiers, comparing them with reference identifiers, according to the comparison results, the selected identifiers do not correspond to the reference identifiers of authorized senders of messages from the memory array M, then G fragments are formed into which the response the response sent to the sender of the messages. After that, G fragments are stored, into which the response response sent to the sender of messages is divided in the memory array P. Next, the counter value m of the generated fragments is set, into which the response response stored in the memory array P is divided equal to G. Then F values of the delay time are formed for each of the fragments into which the response is divided to the sender. After that, F values of the delay time are stored for each of the fragments, into which the response response to the sender is divided in the memory array Z and the correspondences to the g-th fragment from the array P -th generated value of its delay time from the memory array Z are stored in the memory array H. read from the memory array P the first of the G generated fragments of the response response and from the memory array Z the first of the F generated values of the delay time. Then the first of the G fragments of the response response is sent to the sender of the messages through the first of the Z generated delay times. After that, the first of the G generated fragments of the response response and the first of the F generated values of the delay time are removed, as well as a record of their correspondence from the memory arrays P, Z and H, respectively. Next, the value of the counter m of the generated fragments of the response response stored in the memory array P is decreased by one. In the case of receiving, after sending a fragment of the response response, a command to complete the network connection from the sender of e-mail messages, the values of I _c and I _{s are} decreased by one, and the network connection with the sender of the messages is terminated. Otherwise, if, after sending the next fragment of the response response, there is no command to complete the network connection from the sender of e-mail messages, then the value of the counter m of the generated response response fragments is read. If the counter value m ≠ 0, which indicates that not all fragments of the response are sent to the sender of e-mail messages, then the next (g + 1) th of the previously generated G fragments of the response is read. Next, the next (g + lj-th of the previously generated G fragments of the response response is sent through the (ƒ + 1) -e value of the delay time to the sender of e-mail messages, and so on until the condition m = 0 is satisfied, meaning that all fragments of the response response are sent to the sender If, after receiving from the sender of messages a command identifying message recipients, allocating message recipient identifiers, comparing them with reference identifiers, the selected identifiers based on the comparison results do not correspond to the reference identifiers of authorized recipients of messages from the memory array M, then form U response responses to commands from the sender of messages containing error codes in accordance with the specification of the SMTP protocol. After that U response responses are stored in the memory array X and the u-th response response containing an error code is read from X to the command of the sender of e-mail messages. sender of messages electro This mail response contains an error code. If a repeated command is not received from the message sender after the waiting timeout for the received response with an error code or a command to disconnect the established connection has expired, the I _c and I _s values are decreased by one, and the network connection with the message sender is terminated.

The value of the delay time for each of the intermediate responses to the unauthorized sender of e-mail messages, before sending a response by the recipient, is selected in the range from 1 to 10 seconds.

The number of intermediate responses to be sent to the unauthorized sender of e-mail messages before the recipient sends a response is selected between 1000 and 20,000.

The delay time for each of the response fragments sent to the unauthorized sender of e-mail messages is selected in the range from 1 to 15 seconds.

The size of the fragments into which to split the response to the unauthorized sender of e-mail messages is selected in the range from 1 to 3 bytes.

For each false response to an unauthorized sender of e-mail messages, the error code value is randomly selected from standard SMTP error codes.

Thanks to the new set of essential features in the claimed method, an increase in the effectiveness of protection is provided by reducing the possibility of an attacker detecting the fact of using protection means, achieved by simulating a communication channel with poor quality at various stages of a mail transaction, by splitting the response response to the attacker into fragments and sending these fragments through numerous small time delays, sending a response to the attacker after many intermediate responses sent at numerous short time intervals, as well as sending deliberately false messages to the attacker about the temporary or permanent impossibility of continuing the mail transaction.

The claimed objects of the invention are illustrated by drawings, which show:

fig. 1 - Scheme of establishing a network connection and the operation of the SMTP protocol;

fig. 2a - Block diagram of the sequence of actions that implement the claimed method of protecting computer networks;

fig. 2b - Block diagram of the sequence of actions that implement the claimed method of protecting computer networks;

fig. 3 - Fragment of a postal transaction at the time of formation and sending to an unauthorized sender of intermediate responses before the response;

fig. 4 - Fragment of a mail transaction at the time of formation and sending to an unauthorized sender of a response response, divided into many fragments;

fig. 5 - Fragment of a mail transaction at the time of formation and sending to an unauthorized sender of a false response containing an error code.

The implementation of the claimed method is explained as follows. It is known that unsolicited e-mail (spam), where spam is understood as mass mailing of commercial and other advertisements or other types of messages (information) to persons who did not express a desire to receive them, constitutes from 60% to 90% of all e-mails sent worldwide. ... According to Kaspersky Lab data, in Q1 2020 the average share of spam in global mail traffic was 54.61%, the share of spam in traffic in the Russian segment of the Internet also peaked in January 2020 and amounted to 52.08%, and the top five countries in terms of The number of outgoing spam was topped by Russia, accounting for 20.74% of all junk traffic. To combat spam, a number of systems and techniques have been developed and applied for a long time, and most of the well-known methods of protection against spam are known and described, for example, in the article Kovalev S.S., Shishaev M.G. Modern methods of protection against unwanted mailings // Proceedings of the Kola Scientific Center of the Russian Academy of Sciences, vol. 7 (information technology issue 2 4/2011 (7)), on pp. 100-111. The main ones are Bayesian filtering, methods based on formal protocol rules, procedural methods, sender authentication, methods using checksums and block lists, etc. However, all these methods are based mainly on detecting and blocking already received spam messages. and, in fact, they are reactive, reacting to the fact of a perfect malicious impact, and therefore they are effective only when using known spam message templates. In addition, some of the known methods implement attempts to so-called forceful demonstrative blocking of spam messages, for example, methods such as redirecting spam messages to their senders, sending malware treatment tools designed to send viral spam messages to identified spam sources, etc. etc. The use of such countermeasures, on the one hand, leads to the compromise of the applied protection tools, which contributes to their subsequent bypass and / or a change in the strategy of malicious action by the attacker. On the other hand, the effectiveness of protection tools that implement these methods is limited by their resource capabilities, since these methods are computationally intensive and require powerful processors with large amounts of memory for effective use, while the resource of attackers can be practically unlimited, which is confirmed by their the ability to carry out large-scale DOS and DDOS attacks based on mass mailing of spam with the involvement of spambots, which is described, for example, in the article “United Russia” sites were subjected to a large-scale DDoS attack - INTERFAX.RU. URL: https://www.interfax.ru/russia/609414 (date of treatment 05/26/2020).

In this regard, fundamentally new approaches to combating spam, based on preventing the delivery of spam messages from an attacker to a mail server, are gaining relevance. These approaches shift the emphasis on combating spam towards proactive protection, which imposes a restriction on the computing resource used by the attacker and causes "depletion" of its resources during the mail transaction without significant computational costs on the part of the protected computer network. However, the well-known technical solutions discussed above, which implement the issues of proactive protection of computer networks against mass mailing of spam messages, are still insufficiently developed and have significant drawbacks, and the tasks of bringing such protection measures into compliance with the (centralized) idea of countering spam are just beginning to be formulated by individual authors and their cooperatives.

Thus, a number of contradictions arise between the effectiveness of protecting computer networks from spam messages and the ability of attackers to compromise protection means, as well as between the need to manage the resource capabilities of an attacker to organize mass mailing of spam messages and the lack of technical solutions for dynamic management of parameters of mail transactions with intruder. The claimed method is aimed at eliminating these contradictions.

The claimed method is implemented as follows. The SMTP protocol is designed to transport e-mail objects across many computer networks, as is known and described, for example, in the technical specifications (RFC, Request for Comments) of the Internet (see, for example, https://tools.ietf.org/html/ rfc5321). In RFC 821, see https://tools.ietf.org/html/rfc82l, the two hosts participating in an SMTP transaction are described as SMTP-sender (sender) and SMTP-receiver (receiver). An SMTP session is initiated when the sender connects to the recipient and the recipient responds with an appropriate message, as shown in FIG. 1. After establishing the communication channel and agreeing on the parameters, the sender usually initiates a mail transaction, which consists of a sequence of commands specifying the sender and recipient of the e-mail message, as well as the transfer of the message content (including all headers and other structures). SMTP commands and message data are transmitted from sender to recipient via a communication channel in the form of strings. The recipient responds with a response to each of the received commands, which contains a three-digit number (transmitted as three numeric characters), usually followed by a line of text and represents an acknowledgment (or a rejection containing a message with a temporary or permanent error code), transmitted in the form of lines from the recipient to the sender through the communication channel. The dialogue between the sender and the receiver is carried out in stages (command - response - command ...), as shown in FIG. 1. In accordance with RFC 5321, the response text can contain several lines, the number of which is not limited, but in such cases the text must be marked so that the sender can know when the text is complete. This requires the use of a special format for multi-line responses, specifying that each line (except the last) begins with a response code, followed by a hyphen (-), and then text. The last line uses a space instead of a hyphen, followed by text. In multi-line responses, the codes on each line must match. In some cases, data important to the sender is transmitted in the response text.

Below is an example of a multi-line response:

250 - First line

250 - Second line

250-234 Text starting with a number

250 Last line

After the message is complete, the sender can request a disconnect or initiate the next mail transaction. There are three stages in a mail transaction. The start of the transaction is the MAIL command, which identifies the sender. This is followed by one or more RCPT commands that indicate the recipients of the message. The last stage of the transaction begins with the DATA command, which initiates the transmission of mail data, and ends with the end of mail indicator, which also confirms the transaction. Each email object consists of an envelope and content. The SMTP envelope is transmitted as a series of SMTP protocol elements. The envelope contains the sender address (to which error reports should be returned) and one or more recipient addresses, as well as additional information for protocol extensions.

To transfer information between remote local area networks by means of interaction protocols, a communication channel is established, which is understood as information flows from the sender to the recipient. The structure of message packets is known, and the principle of packet transmission in computer networks is also known, which makes it possible to analyze the source and destination identifiers of information flows and generate reference identifiers. So, the set of fields of the addresses of the sender and recipient of a packet of messages are identifiers of information flows. In addition, the domain specified or specified by the SMTP client will identify the sender and final recipient of the message. In other cases where SMTP clients are bundled with POP protocol implementations as per RFC 937 https://tools.ietf.org/html/rfc937, RFC 1939 https://tools.ietf.org/html/rfcl939 and IMAP as per with RFC 3501 https://tools.ietf.org/html/rfc3501 or the client resides inside an isolated transport environment, the identified domain will determine the intermediate recipient through which all e-mail messages will be broadcast.

FIG. 2 shows a block diagram of the sequence of actions that implement the claimed method of protecting computer networks, in which the following designations are adopted:

N≥1 - base of reference identifiers of authorized senders and recipients of e-mail messages;

I _c - counter of connections of the message sender;

I _cmax - the maximum possible number of connections from the sender of e-mail messages;

M is a memory array for storing reference identifiers of authorized senders of e-mail messages;

I _s - counter of the total number of connections of all senders of e-mail messages;

I _smax - the maximum possible number of connections for all senders of e-mail messages;

L is a memory array for storing t generated values of the delay time of intermediate responses to the sender of e-mail messages, where t = 1, 2, ..., T, and T is the total number of generated values of the delay time of intermediate responses to the sender of messages;

V is an array of memory for storing d intermediate responses to the sender of e-mail messages, where d = l, 2 ... R, a R is the total number of intermediate responses that will be sent to the sender of e-mail messages before the response message;

- счетчик сформированных промежуточных откликов, хранящихся в массиве памяти V;

- counter of generated intermediate responses stored in the memory array V;

J is a memory array for storing a matrix of correspondence with the d-th intermediate response from the array V of the t-th generated value of the delay time for sending it to the sender of e-mail messages from the memory array L;

P is an array of memory for storing g fragments into which the response response sent to the message sender is divided, where g = 1, 2, ..., G, and G is the total number of formed fragments into which the response response sent to the message sender is divided;

Z is a memory array for storing ƒ generated values of the delay time for the transmission of response fragments to the sender of e-mail messages, where ƒ = 1, 2,…, F, and F is the total number of generated values of the delay time for sending response fragments to the sender of e-mail messages;

m - counter of formed fragments, into which the response is divided, stored in the memory array P;

H - memory array for storing the matrix of correspondence to the g-th fragment from the P array of the ƒ-th generated value of its delay time from the memory array Z;

X is an array of memory for storing and responding to commands from the sender of messages containing error codes in accordance with the SMTP protocol specification, where u = 1, 2,… U, and U is the total number of responses to commands from the sender of messages containing error codes.

To improve the effectiveness of protection by reducing the likelihood of an attacker discovering the fact of using protection means, they simulate a communication channel with poor quality. To do this, in the preset data to exclude the possibility of identification by the attacker of the protection means by long delays in response from the recipient of e-mail messages, as well as to prevent the possibility of the attacker bypassing the protection means by setting short timeouts for waiting for response responses, in the preset data, additionally set (see block 1 in Fig.2a) a memory array L for storing t generated values of the delay time of intermediate responses to the sender of e-mail messages, where t = 1, 2, ..., T, and T is the total number of generated values of the delay time of intermediate responses to the sender messages. The use of time intervals t, during which intermediate replies will be sent to the sender of messages, is used to increase the time of dialogue with the sender of spam messages during a mail transaction, for example, as shown in FIG. 3.

Then set (see block 1 in Fig.2a) a memory array V for storing d intermediate responses to the sender of email messages, where d = 1, 2 ... R, and R is the total number of intermediate responses that will be sent to the sender of email messages before reply message. In order to define an array of memory, statically or dynamically allocate the amount of RAM (in bytes).

счетчик сформированных промежуточных откликов, хранящихся в массиве памяти V.Next, set (see block 1 in Fig.2a)

counter of generated intermediate responses stored in memory array V.

After that, a memory array J is set (see block 1 in Fig. 2a) to store the matrix of correspondence to the d-th intermediate response from the array V of the t-th generated value of the delay time for sending it to the sender of e-mail messages from the memory array L.

Then, to increase the effectiveness of the protection method and reduce the likelihood of an attacker detecting the fact of using protection means, the response response to the sender's commands is split into fragments and these fragments are sent to the sender at numerous small time intervals, which makes it impossible for the attacker to bypass the means of protection through the use of short timeouts. waiting for a response, for example, as shown in FIG. 4. To do this, in the preset data additionally set (see block 1 in Fig. 2a) a memory array P for storing g fragments into which the response response sent to the message sender is divided, where g = 1, 2, ..., G, a G is the total number of formed fragments into which the response response sent to the sender of the messages is divided.

Then, a memory array Z is set (see block 1 in Fig. 2a) for storing анных generated values of the delay time for the transmission of response fragments to the sender of e-mail messages, where ƒ = 1, 2, ..., F, and F is the total number of generated time values delays in sending response fragments to the sender of e-mail messages.

Next, set (see block 1 in Fig.2a) a counter m formed fragments, into which the response is divided, stored in the memory array P.

After that, a memory array H is set (see block 1 in Fig. 2a) for storing the matrix of correspondence to the g-th fragment from the array P of the сформиров-th generated value of its delay time from the memory array Z.

Further, to mislead the attacker about the status of the mail transaction and increase the time of dialogue with him, as well as to prevent the process of sending spam messages by spam bots that are unable to correct errors received in the response response and send repeated commands to the recipient after correction, when the attacker is identified , response responses containing an error code will be sent to it regardless of whether it responds correctly to the response response, for example, as shown in FIG. 5. To do this, set (see block 1 in Fig. 2a) an array of memory X for storing u response responses to commands of the sender of messages containing error codes in accordance with the specification of the SMTP protocol, where u = 1, 2, ... U, a U - the total number of responses to the commands of the sender of messages containing error codes.

Then, if after establishing a network connection with the sender (see block 2 in Fig.2a), sending the sender initiating the SMTP session (see block 3 in Fig.2a), increasing the values of I _s (see block 4 in Fig.2a) ) and I _c (see block 5 in Fig.2a) per unit, comparing the values of I _s and I _smax (see block 6 in Fig.2a), and if the condition I _s ≥I _{smax of} reception is satisfied (see block 7 in Fig.2a) identifying the sender of the command, allocating (see block 8 in Fig.2a) sender identifiers and comparing them (see block 9 in Fig.2a) with reference ones, the allocated identifiers do not correspond to the reference identifiers of authorized message senders from the array memory M, then generate (see block 10 in Fig. 2a) R intermediate responses, which will be sent to the sender of e-mail messages before the response response.

сформированных промежуточных откликов, хранящихся в массиве памяти V равным R.After that, R intermediate responses are stored (see block 11 in Fig. 2a) in the memory array V and the counter value is set (see block 12 in Fig. 2a)

generated intermediate responses stored in the memory array V equal to R.

Next, T values of the delay time of intermediate responses to the message sender are generated (see block 13 in Fig. 2a) and T values of the delay time of intermediate responses to the message sender are stored (see block 14 in Fig. 2a) in the memory array L.

After that, remember (see block 15 in Fig.2a) in the memory array J the correspondence to the d-th intermediate response from the array V of the t-th generated value of its delay time from the memory array L.

Then read (see block 16 in Fig. 2a) from the memory array J the first of the R generated intermediate responses and from the memory array L the first of the T generated delay time values.

Next, the first of the R generated intermediate responses is sent (see block 17 in Fig. 2a) to the message sender through the first of the T generated delay time values. This achieves an increase in the duration of the dialogue with the sender of the messages.

After that, the first of the R generated intermediate responses and the first of the T generated delay time values are deleted (see block 18 in Fig. 2a), as well as a record of their correspondence from the memory arrays V, L and J, respectively.

сформированных промежуточных откликов, хранящихся в массиве памяти V на единицу.Then decrease (see block 19 in Fig.2a) the value of the counter

generated intermediate responses stored in the memory array V per unit.

If, after sending an intermediate response, a command to complete a network connection is received from the sender of e-mail messages (see block 20 in Fig.2a), the values of I _c and I _{s are} decreased by one (see block 53 in Fig.2b), and the network connection with the message sender ends (see block 54 in Fig. 2b).

сформированных промежуточных откликов.Otherwise, if, after sending the intermediate response, there is no command to complete the network connection from the sender of the e-mail messages, then read (see block 21 in Fig.2a) the value of the counter

generated intermediate responses.

что говорит о том, что еще не все промежуточные отклики направлены отправителю сообщений электронной почты, то считывают (см. блок 16 на фиг. 2а) очередной (d+1)-й из ранее сформированных R промежуточных откликов.Further, if the value of the counter

which means that not all intermediate responses have been sent to the sender of e-mail messages, then the next (d + 1) th of the previously generated R intermediate responses is read (see block 16 in Fig. 2a).

(см. блок 21 на фиг. 2а), означающее, что все промежуточные отклики направлены отправителю.After that, the next (d + 1) th of the previously generated R intermediate responses is sent (see block 17 in Fig. 2a) through the (t + 1) th value of the delay time to the sender of the e-mail messages, and so on until the condition will not be met

(see block 21 in Fig. 2a), meaning that all intermediate responses are sent to the sender.

направляют (см. блок 22 на фиг. 2а) ответный отклик отправителю сообщений электронной почты.Then after fulfilling the condition

sending (see block 22 in Fig. 2a) a response response to the sender of the e-mail messages.

If, after receiving (see block 23 in Fig. 2a) from the sender of messages, the command to start a mail transaction, allocation of sender identifiers (see block 24 in Fig. 2a), their comparison with reference identifiers (see block 25 in Fig. 2a), based on the comparison results, the selected identifiers do not correspond to the reference identifiers of authorized message senders from the memory array M, then G fragments are formed (see block 27 in Fig. 2a) into which the response response sent to the message sender is divided.

After that, G fragments are stored (see block 28 in Fig.2a) into which the response response sent to the sender of the messages is divided in the memory array P.

Next, set (see block 29 in Fig.2a) the value of the counter m of the generated fragments, into which the response is divided, stored in the memory array P equal to G.

Then form (see block 30 in Fig. 2a) F values of the delay time for each of the fragments into which the response is divided to the sender.

After that, F values of the delay time for each of the fragments are stored (see block 31 in Fig.2a) F values of the delay time for each of the fragments, into which the response response to the sender is divided in the memory array Z and stored (see block 32 in Fig.2b) in the memory array H of the correspondence g -th fragment from the P array of the го-th generated value of its delay time from the memory array Z.

Next, read (see block 33 in Fig. 2b) from the memory array P the first of the G generated fragments of the response response and from the memory array Z the first of the F generated delay time values.

Then the first of the G fragments of the response response is sent (see block 34 in Fig. 2b) to the message sender through the first of the Z generated delay times.

After that, the first of the G generated fragments of the response response and the first of the F generated delay time values are deleted (see block 35 in Fig. 2b), as well as a record of their correspondence from the memory arrays P, Z and H, respectively.

Next, the value of the counter m of the generated response response fragments stored in the memory array P is reduced (see block 36 in Fig. 2b) by one. This ensures that the sent response fragments are accounted for.

In the case of receiving, after sending a fragment of the response response, a command to complete the network connection from the sender of e-mail messages (see block 37 in Fig.2b), the values of I _c and I _s decrease by one (see block 53 in Fig.2b), and the network the connection with the message sender is terminated (see block 54 in FIG. 2b).

Otherwise, if after sending the next fragment of the response response there is no command to complete the network connection from the sender of e-mail messages, then read (see block 38 in Fig. 2b) the value of the counter m of the generated response response fragments.

If the value of the counter m ≠ 0, which indicates that not all fragments of the response have been sent to the sender of e-mail messages, then the next (g + l) -th from earlier is read (see block 33 in Fig. 2b). formed G fragments of the response. Next, the next (g + 1) th of the previously generated G fragments of the response response is sent (see block 34 in Fig. 2b) through the (ƒ + 1) -e value of the delay time to the sender of the e-mail messages, and so on until the condition m = 0 will not be met, which means that all fragments of the response are sent to the sender.

If, after receiving (see block 39 in Fig.2b) from the sender of messages, the command identifying the recipients of the messages, comparing (see block 40 in Fig.2b) the values _{Ic of the} counter of the number of connections of the sender of messages I _{cmax with the} maximum possible number of connections of the sender messages and in the case of fulfilling the condition I _c ≥I _cmax allocation (see block 41 in Fig.2b) identifiers of message recipients, their comparison (see block 42 in Fig.2b) with reference identifiers, the allocated identifiers do not correspond to the reference identifiers according to the comparison results authorized recipients of messages from the memory array M, then form (see block 43 in Fig. 2b) U response responses to commands of the sender of messages containing error codes in accordance with the specification of the SMTP protocol.

After that, U response responses are stored (see block 44 in Fig. 2b) in the memory array X and read (see block 45 in Fig. 2b) from the X u-th response response containing an error code to the command of the sender of e-mail messages ...

Next, a response response containing an error code is sent (see block 46 in Fig. 2b) to the sender of the e-mail messages.

If a repeated command is not received from the message sender after the timeout expires for the received response with an error code or receipt (see block 47 in Fig.2b) of the command to disconnect the established connection, the values of I _c and I _{s are} decreased by one ( see block 53 in Fig. 2b), and the network connection with the message sender is terminated (see block 54 in Fig. 2b).

Otherwise, a response is sent to the sender of e-mail messages (see block 48 in Fig.2b), after which a command is received (see block 49 in Fig.2b), initiating the transfer of mail data, a response is sent to the sender (see block 50 in Fig. 2b), then the text of the e-mail message is received (see block 51 in Fig. 2b) and the mail transaction is completed (see block 52 in Fig. 2b). Further, the values of I _c and I _{s are} decreased by one (see block 53 in Fig. 2b), and the network connection with the message sender is terminated (see block 54 in Fig. 2b).

To avoid the compromise of security measures by a constant value of the delay time of intermediate responses, the delay time for each of the intermediate responses to the unauthorized sender of e-mail messages, before sending a response by the recipient, is selected in the range from 1 to 10 seconds.

The number of intermediate responses to be sent to the unauthorized sender of e-mail messages before the recipient sends a response is selected between 1000 and 20,000.

The delay time for each of the response fragments sent to the unauthorized sender of e-mail messages is selected in the range from 1 to 15 seconds.

The size of the fragments into which to split the response to the unauthorized sender of e-mail messages is selected in the range from 1 to 3 bytes.

For each false response to an unauthorized sender of e-mail messages, the error code value is randomly selected from standard SMTP error codes.

Thus, the claimed method ensures the achievement of the formulated goal, which is to increase the effectiveness of protection by reducing the possibility of an attacker detecting the fact of using protection means, achieved by simulating a communication channel with poor quality at various stages of a mail transaction, by splitting the response to the attacker into fragments and directions of these fragments at numerous short time intervals, forwarding a response to the attacker after many intermediate responses sent at multiple short time intervals, as well as sending deliberately false messages to the attacker about the temporary or permanent impossibility of continuing the mail transaction.

Claims (6)

1. A method for protecting computer networks, which preliminarily sets N≥1 reference identifiers of authorized senders and recipients of e-mail messages, I _c counter of the number of connections of the sender of messages, I _{cmax the} maximum possible number of connections of the sender of e-mail, t _pre the delay time through which the response is transmitted to the sender of e-mail messages, M memory array for storing the reference identifiers of authorized senders of e-mail messages, I _s counter of the total number of connections of all senders of e-mail messages, I _{smax the} maximum possible number of connections of all senders of e-mail messages, establish a network connection with the sender of mail messages, send a response to the sender, initiating the beginning of an SMTP session from the recipient, increase the value of the counter I _{c the} number of connections from the sender of messages by one, increase t the value of the counter I _{s of the} total number of connections from all senders of messages, compare the value of the counter I _{s of the} number of connections from all senders of messages with I _{smax with the} maximum possible number of connections of all senders of messages, if the condition I _s ≥I _{smax is satisfied} , the values of I _c and I _{s are reduced} by one, complete the network connection with the sender of mail messages, otherwise, if the condition I _s ≥I _smax is not met, they receive a command that initiates the sender of mail messages and identifies him, extract the sender's identifiers from the received command, compare the allocated sender identifiers with the reference identifiers from the memory array M, if, according to the comparison results, the allocated identifiers correspond to the reference identifiers of the authorized senders of messages from the memory array M, then a response is sent to the sender of messages about the readiness for a mail transaction, otherwise, if the comparison results allocated IDs do not correspond to the reference identifiers authorized senders messages from the memory array M, the formed back response is set t _zad delays transmitting the generated response RTT, after the time t _zad guide formed back a response to the sender in case of reception during t _3a d before sending from the sender of the e-mail response team response to completion of the network connection reduces the values of I _c and I _s on the unit, complete the network connection to the sender of e-mail messages, otherwise, if at time t _zad before sending a response response team to complete the network connection from the the sender of e-mail messages did not follow, then send a response response to the sender, receive a command from the sender to start a mail transaction that identifies the sender of e-mail messages, extract the sender's identifiers from the received command, comparing separate identifiers of the sender of messages with reference identifiers from the memory array M, if, according to the comparison results, the allocated identifiers correspond to the reference identifiers of authorized senders of messages from the memory array M, then send a response to the sender of messages about the receipt of the received command and the beginning of the mail transaction, otherwise, if according to the comparison results, the selected identifiers do not correspond to the reference identifiers of authorized senders of messages from the memory array M, then form a response response, set t _back the delay time for transmitting the generated response response, after the expiration of time t _back, send the generated response response to the sender, if received at time t _back before sending a response, commands to terminate the network connection from the sender of e-mail messages decrease the values of I _c and I _s by one, terminate the network connection with the sender of mail messages, otherwise ae, if at time t _zad before sending a response response team to complete the network connection is not followed by the sender's e-mail messages, is sent to the sender back a response is received from the sender communications command indicating the recipients e-mail message, comparing the count value I _c the number of connections the sender of messages with I _{cmax the} maximum possible number of connections of the sender of messages, when the condition I _c ≥I cmax is _satisfied , the values of I _c and I _{s are} reduced by one, the network connection with the sender of mail messages is terminated, otherwise, if the condition I _c ≥I _{cmax is not met} receive a command indicating the recipients of the e-mail message, extract the message recipient identifiers from the received command, compare the allocated message recipient identifiers with the reference identifiers from the memory array M, if, based on the comparison results, the allocated identifiers correspond to the authorized identifiers recipients of messages from the memory array M, then send a response to the sender of messages about the readiness to continue the mail transaction, otherwise, if, according to the comparison results, the allocated identifiers do not correspond to the reference identifiers of authorized recipients of messages from the memory array M, then form a response response, set t _back the delay time for the transmission of the generated response response, after the expiration of time t _back , the generated response response is sent to the sender, if received at time t _back, before sending the response response, the command to complete the network connection from the sender of e-mail messages is decreased the values of I _c and I _s by one, complete network connection with the sender of e-mail messages, otherwise, if at time t _zad response before sending response teams to complete the network connection from the sender of the e-mail messages are not followed, then sent back to the sender response, take the next command, initiating the transmission of mail data, send the sender of the messages a response response about the readiness to receive the text of the email message, receive the text of the email message, complete the mail transaction by transmitting a response confirming the transaction, decrease the values of I _c and I _s by one, terminate the network connection with by the sender of mail messages, characterized in that in the preset data, an L memory array is additionally set for storing t generated values of the delay time of intermediate responses to the sender of email messages, where t = 1, 2, ..., T, and T is the total number of generated time values delays of intermediate responses to the sender of messages, V is an array of memory for storing d intermediate responses to the sender of email messages, d = 1, 2 ... R, where R is the total number of intermediate responses that will be sent to the sender of email messages before the reply message,

counter of generated intermediate responses stored in the memory array V, J memory array for storing the matrix of correspondence with the d-th intermediate response from the array V t-th generated value of the delay time for sending it to the sender of e-mail messages from the memory array L, P memory array for storing g fragments into which the response response sent to the message sender is divided, where g = 1, 2, ..., G, and G is the total number of formed fragments into which the response response sent to the message sender is divided, Z is a memory array for storing ƒ generated delay time values transmission of response fragments to the sender of e-mail messages, where ƒ = 1, 2, ..., F, a F is the total number of generated values of the delay time for sending response fragments to the sender of e-mail messages, m counter of formed fragments into which the response response is stored in memory array P, H memory array for storage matrices of correspondence to the g-th fragment from the array P сформиров -th generated value of its delay time from the memory array Z, X is the memory array for storing and responding to the sender's commands of messages containing error codes in accordance with the specification of the SMTP protocol, where u = 1 , 2, ... U, a U is the total number of response responses to the sender's commands of messages containing error codes, if after receiving a command identifying the sender, allocating sender identifiers and comparing them with reference ones, the allocated identifiers do not correspond to the reference identifiers of authorized senders of messages from of the memory array M, then R intermediate responses are generated, which will be sent to the sender of e-mail messages before the response response, R intermediate responses are stored in the memory array V, the counter value is set

generated intermediate responses stored in the memory array V equal to R, form T values of the delay time of intermediate responses to the message sender, store T values of the delay time of intermediate responses to the message sender in the memory array L, store in the memory array J the correspondence to the d-th intermediate response from the array V t-th generated value of its delay time from the memory array L, read from the memory array J the first of the R generated intermediate responses and from the memory array L the first of the T generated delay time values, send the message sender the first of the R generated intermediate responses through the first of the T generated delay time values, remove the first of the R generated intermediate responses and the first of the T generated delay time values, as well as a record of their correspondence from the memory arrays V, L and J, respectively, decrease the counter value

generated intermediate responses stored in the memory array V by one, if after sending an intermediate response, a command to terminate a network connection from the sender of e-mail messages is received, the values of I _c and I _{s are} decreased by one, and the network connection with the sender of messages is terminated, otherwise if, after sending an intermediate response, there is no command to end the network connection from the sender of the e-mail messages, then the counter value is read

generated intermediate responses, if the counter value

which means that not all intermediate responses have been sent to the sender of e-mail messages, then the next (d + l) th of the previously generated R intermediate responses is read, the next (d + l) th of the previously generated R intermediate responses is sent through (t + l) -e value of the delay time to the sender of e-mail messages, and so on until the condition is met

meaning that all intermediate responses are sent to the sender after the condition

send a response to the sender of e-mail messages, if, after receiving from the sender of messages commands to start a mail transaction, allocating sender identifiers, comparing them with reference identifiers, based on the comparison results, the selected identifiers do not correspond to the reference identifiers of authorized senders of messages from the memory array M, then form G fragments, into which the response response sent to the message sender is divided, G fragments are stored into which the response response sent to the message sender is divided into the memory array P, the counter value m of formed fragments is set into which the response response stored in the memory array is divided P equal to G, F values of the delay time are formed for each of the fragments into which the response response to the sender is divided, F values of the delay time are stored for each of the fragments into which the response response to the sender is divided in the memory array Z, store in the memory array H the correspondence to the g-th fragment from the array P ƒ -th generated value of its delay time from the memory array Z, read from the memory array P the first of G formed fragments of the response response and from the memory array Z the first of F formed values delay time, send the first of the G fragments of the response response to the sender of the messages through the first of the Z generated delay time values, remove the first of the G generated response response fragments and the first of the F generated delay time values, as well as a record of their correspondence from the memory arrays P, Z and H, respectively, decrease the value of the counter m of the generated response response fragments stored in the memory array P by one, in the case of receiving after sending the response response fragment of the command to complete the network connection from the sender of e-mail messages, the values of I _c and I _s decrease by one, and the network connection with the sender of the messages is completed. If, after sending the next fragment of the response response, there is no command to terminate the network connection from the sender of e-mail messages, then the counter value m of the generated response response fragments is read, if the value of the counter m ≠ 0, which indicates that that not all fragments of the response are sent to the sender of e-mail messages, then the next (g + 1) th of the previously formed G fragments of the response is read, the next (g + 1) th of the previously formed G fragments of the response is sent through ( ƒ + 1) -th value of the delay time to the sender of e-mail messages, and so on until the condition m = 0 is satisfied, which means that all fragments of the response are sent to the sender, if after receiving the command from the sender of the messages, the command identifying the recipients messages, allocation of message recipient identifiers, their comparison with reference identifiers based on the results of the the allocated identifiers do not correspond to the reference identifiers of authorized message recipients from the memory array M, then U response responses to the sender's commands containing error codes are generated in accordance with the SMTP protocol specification, U response responses are stored in the memory array X, read from X u-th a response response containing an error code to a command from the sender of e-mail messages, a response response containing an error code is sent to the sender of e-mail messages, if a second command is not received from the sender of the messages after the waiting timeout for the received response with an error code or a command has been received on the disconnection of the established connection, the values of I _c and I _{s are} decreased by one, and the network connection with the message sender is terminated. 2. The method according to claim 1, characterized in that the value of the delay time for each of the intermediate responses to the unauthorized sender of e-mail messages, before sending a response by the recipient, is selected in the range from 1 to 10 seconds. 3. The method according to claim 1, characterized in that the number of intermediate responses sent to the unauthorized sender of e-mail messages before sending the response by the recipient is selected in the range from 1000 to 20,000. 4. The method according to claim 1, characterized in that the delay time value for each of the response fragments sent to the unauthorized sender of e-mail messages is selected in the range from 1 to 15 seconds. 5. The method according to claim 1, characterized in that the size of the fragments into which the response response to the unauthorized sender of e-mail messages is split is selected in the range from 1 to 3 bytes. 6. The method according to claim 1, characterized in that for each false response to an unauthorized sender of e-mail messages, the error code value is randomly selected from standard SMTP error codes.

Images