RU2814463C1 - Method for protection of computer networks based on legendizing - Google Patents

Abstract

FIELD: physics; providing security of communication networks.

SUBSTANCE: invention relates to communication networks security and can be used in systems for detecting computer attacks in order to quickly detect and counteract unauthorized actions in computer networks. Result is ensured by implementing the legendizing of the sequence of providing information resources by generating a sufficient set of legends for interacting with unauthorized information flows taking into account network location of their sources.

EFFECT: higher security of computer networks.

1 cl, 2 dwg

Description

The invention relates to the field of ensuring the security of communication networks and can be used in computer attack detection systems in order to increase the security of computer networks from destructive influences.

Known “Method for monitoring information flows in digital communication networks” according to RF patent No. 2267154, ClassG06F 15/40, app. 07/13/2004, which consists in pre-settingN≥1 reference identifiers of authorized information flows (IPs) containing the addresses of senders and recipients of message packages, receive a message package from the communication channel, extract an PI identifier from the header of the received message package, compare the selected identifier with predefined reference identifiers of authorized PIs and, if they match, transmit message package to the recipient, and if they do not match, the sender address specified in the identifier of the received message package is compared with the sender addresses specified in the reference identifiers of authorized IPs.

Also known is the “Method for protecting computer networks” according to RF patent No. 2307392, ClassG06F 21/00,H04L 9/32, app. 05/02/2006, which consists in pre-settingR≥1 false addresses of computer network subscribers, standards of identifiers of the type of interaction protocols, delay time for sending message packetst _ass, and if the selected identifiers of the next received packet do not match the identifiers of the previously rememberediof the th unauthorized individual entrepreneur, the address of the recipient in the received packet of messages is compared with pre-specified false addresses of subscribers of the computer network, and if they do not match, as well as if the condition is metK _i >K _max , block the transmission of a package of messages and proceed to receiving the next package of messages, and if the sender's address in the received package of messages does not match the addresses of the senders of the reference identifiers of authorized IPs or the recipient's address in the received package of messages matches the addresses of recipients of the reference identifiers of authorized IPs, or it coincides with the previously using the given false addresses of computer network subscribers, they remember the identifier of the next unauthorized IP, increase the number of its appearances by oneTO _i and if the condition is not metTO _i ≥TO _max , form a response message packet corresponding to the identified interaction protocol, and then, after a specified delay time, send message packetst _ass they reduce the transmission speed of the generated message package and transmit it to the sender, after which they receive the next message package from the communication channel.

Also known is the “Method for protecting computer networks” according to RF patent No. 2475836, ClassG06F 21/00,H04L 9/32, publ. 02/20/2016, bulletin. No. 5, which is that they ask set of reference sets of occurrences of unauthorized IPs with different identifiersS _this={S _j }, Wherej - a specified number of reference sets corresponding to certain types of computer attacks,S _j ={WITH _r }, Where WITH _r - a certain sequence of appearances of an unauthorized IP, differing from each other by identifiers, and also set threshold meaning coincidence rateQ _{match_threshold} sequence of appearances of an unauthorized IP with the corresponding reference set. After extracting identifiers from the header of the next received message package and comparing them with the reference identifiers, if the recipient's address in the received message package of an unauthorized individual entrepreneur does not match with the specified false addresses of computer network subscribers, it is additionally added to the list of predefined false addresses of computer network subscribers. Then the message package of the unauthorized IP is transmitted to the specified false addresses of subscribers of the computer network, and the unauthorized IP is identified. Why compare spawn IDsTO _i received IP with valuesWITH _r in reference setsS _j appearances of unauthorized IPs, and if there is a discrepancy, a new one is formedS _{j +1} reference set and remember it in the set of reference sets of occurrences of an unauthorized IP, and if there is a match, remember the numbers of the reference sets to which it belongsi-th appearance of an unauthorized individual entrepreneur. Then they compare values received coincidence rateQ _coincidence with threshold meaningQ _{match_threshold.} and when the condition is metQ _coincidence Q _{match_threshold} blocki-th unauthorized IP, and generate an attack signal on the computer network, and if the condition is not met after the formation of a response packet of messages, they increase delay time for sending message packagest _ass for a given time interval.

The closest in technical essence to the proposed method is “Method for protecting computer networks based on adaptive interaction” according to RF patent No. 2715165, ClassG06F 21/00,G06F 12/14,H04L 9/32, publ. 02/25/2020, bulletin. No. 6. The prototype method consists of the following steps: first remember N≥1 reference identifiers of authorized PIs containing addresses of senders and recipients of message packages, set R≥1 false addresses of computer network subscribers, set set of reference sets of appearances of unauthorized IPs, differing from each other by identifiersS _this={S _j }, Wherej - a specified number of reference sets corresponding to certain types of computer attacks, in whichS _j ={WITH _r }, WhereWITH _r - a certain sequence of appearances of an unauthorized IP, differing from each other in identifiers, receives the next packet of messages and determines its legitimacy, for which purpose identifiers are extracted from its header, which are compared with the reference identifiers and, if they match, the legitimate packet of messages is transmitted to the recipient, after which the next packet is received messages and repeat a set of actions to determine its legitimacy, and if there is no match, they remember the identifiers of the accepted unauthorized IP and assign it anotherith identification number, then transmit the message packet of the unauthorized IP to the given false addresses of subscribers of the computer network and identify the unauthorized IP, for which they compare spawn IDsTO _i received unauthorized IP with valuesWITH _r in reference setsS _j appearances of unauthorized IPs and, if they coincide, are blocked transmission of a package of messages and proceed to receiving the next package of messages, and if there is a mismatch, they form a response package of messages, characterized in that a variety of information resources are additionally specified in the initial dataP _extra available on everyR false address of computer network subscribers, and also set the initial threshold meaning coincidence rateQ ^beginning _{coincidence threshold}and final threshold meaning coincidence rateQ ^con _{coincidence threshold}sequence of appearances of an unauthorized IP with the corresponding reference setj, after transmitting a message packet from an unauthorized IP to the given false addresses of computer network subscribers, appearance identifiers are extracted from themTO _i unauthorized individual entrepreneur, and determine the required information resource for itP _extra, after which they provide it for interaction with the corresponding appearance of an unauthorized individual entrepreneurTO _i , then calculate current meaning coincidence rateQ ^tech _coincidence sequences of appearances of an unauthorized IP with reference setsS _this, after which they compare values received coincidence rateQ ^tech _coincidence with initial threshold meaningQ ^beginning _{coincidence threshold} and when the condition is metQ ^tech _coincidence Q ^beginning _{coincidence threshold} remember the reference setS _j corresponding to the current sequence of appearances of an unauthorized IP, and if the condition is not met, the next packet of messages is received to further determine its legitimacy, then compared values received coincidence rateQ ^tech _coincidence with finite threshold meaningQ ^con _{coincidence threshold} and when the condition is metQ ^tech _coincidence Q ^con _{coincidence threshold} blockith unauthorized IP and generate an attack signal on the computer network, and if the conditions are not met, the subsequent appearance ofWITH _{i +1} unauthorized IP from the stored reference setS _j and form a response message packet for it, and then transmit it.

The technical problem lies in the low security of computer networks, due to the fact that the implemented interaction of false computer network addresses with unauthorized IPs does not take into account the possibility of forming a certain sequence of providing information resources in the form of a legend.

The technical problem is solved by implementing the formation of a certain sequence of providing information resources when interacting with unauthorized individual entrepreneurs.

The technical result is to increase the security of computer networks from destructive influences by implementing legends for the sequence of provision of information resources by generating a sufficient number of legends for interaction with unauthorized IPs, taking into account the network location of their sources.

The technical problem is solved by the fact that in the method of protecting computer networks based on legend, which consists in pre-storing N≥1 reference identifiers of authorized PIs containing addresses of senders and recipients of message packages, set R≥1 false addresses of computer network subscribers, receive the next packet of messages, and determine its legitimacy, for which they extract identifiers from its header, which are compared with the reference identifiers, and if they match, they transmit the legitimate packet of messages to the recipient. After which they accept the next package of messages and repeat the set of actions to determine its legitimacy, and if there is no match, they remember the identifiers of the received unauthorized IP and assign it the nextith identification number. Then the message packet of the unauthorized IP is transmitted to the specified false addresses of computer network subscribers. Additionally, multiple sets of information resources are specifiedZ = {Z _l }, Wherel - a given number of sets of information resources,Z _l ={V _c }, WhereV _c - a certain sequence of information resources in a specific set available on eachR false addresses of computer network subscribers, and also set many reference sets of correspondence of identifiers of unauthorized individual entrepreneurs to sets of information resourcesR _this ={R _j }, Wherej - a specified number of reference sets of correspondence between identifiers of unauthorized individual entrepreneurs and a specific set of information resources. After transmitting a message packet from an unauthorized IP to the specified false addresses of computer network subscribers and identifying the appearance identifiers from themTO _i unauthorized IP is compared with the values in the reference setsR _j correspondence of identifiers of unauthorized individual entrepreneurs to a specific set of information resources. If there is a discrepancy, a free set of information resources is determinedZ _l and provide the first information resource from itV ₁ to begin interaction with the corresponding manifestation of an unauthorized individual entrepreneurTO _i . Also form a newR _{j +1} a reference set of correspondence between identifiers of unauthorized individual entrepreneurs and a specific set of information resources and store it in a plurality of reference sets of correspondence between identifiers of unauthorized individual entrepreneurs and sets of information resourcesR _this. If there is a match, a set of information resources is determinedZ _l corresponding to the manifestation of an unauthorized individual entrepreneurTO _i . Then the information resource is determinedV _{c + 1} next in the sequence of information resources of the corresponding set of information resourceZ _l . Then they provide it for interaction with the corresponding manifestation of the unauthorized individual entrepreneurTO _i . Then the value of the provided information resource is comparedV _{c + 1} with a finite value of the information resourceV _WITH in this set of information resourcesZ _l . When the condition is metV _{c + 1}=V _WITH blockith unauthorized IP, and generate an attack signal on the computer network. If the condition is not met, a response message packet is generated from the current information resource and then transmitted.

The listed new set of essential features ensures increased security of computer networks by implementing legends for the sequence of provision of information resources by generating multiple legends for interaction with unauthorized individual entrepreneurs, taking into account the network location of their sources.

The analysis of the state of the art made it possible to establish that there are no analogues characterized by sets of features identical to all the features of the claimed method. Consequently, the claimed inventions meet the patentability condition of “novelty”.

The results of a search for known solutions in this and related fields of technology in order to identify features that coincide with the features of the claimed invention that are distinctive from the prototypes, showed that they do not follow explicitly from the prior art. The prior art determined by the applicant does not reveal the impact of the essential features of the claimed invention on achieving the specified technical result. Therefore, the claimed invention meets the patentability requirement of “inventive step”.

The “industrial applicability” of the method is due to the presence of an elemental base on the basis of which devices that implement this method can be made to achieve the result specified in the invention.

The claimed method is illustrated by drawings, which show:

in fig. 1 - diagram explaining the construction of the network under consideration;

in fig. 2 - method of protecting computer networks based on legends.

The implementation of the claimed method can be illustrated in the diagram of a computer network (CN), shown in Fig. 1.

The presented computer consists of a router 1 connecting the internal computer network 2 to the external network 3. The internal computer network consists of a protected local area network (LAN) 4 and a false LAN 5. In the general case, the protected LAN 4 is a collection of PCs 4.1 ₁ -4.1 _N , peripheral and communication equipment 6 ₁ , 6 ₂ , united by physical communication lines. All these elements are defined by identifiers, which in the most common TCP / IP protocol stack are network addresses ( IP addresses). False LAN 5 consists of PCs 5.1 ₁ -5.1 _P having false addresses, as well as network elements, including a set of information resources 5.2 ₁ -5.2 _Z . In addition, there is a security tool 7 and a database 8 of sets of information resources. At the same time, a specific set represents a strictly defined sequence of information resources that implements a given legend. Also, to implement the possibility of accounting for the network location of sources of unauthorized IP, there is a database of 9 reference sets of correspondence between identifiers of unauthorized IP and sets of information resources. This database is necessary to determine the set of information resources that were previously provided for interaction with specific unauthorized individual entrepreneurs, which allows the same set of information resources to be used during repeated interactions.

In fig. 2 presents a method for protecting computer networks based on legends, where the following notations are adopted:

N ≥1 - a base of reference identifiers of authorized IPs containing the addresses of senders and recipients of message packages;

P ≥1 - base of false addresses of computer network subscribers;

ID - IP identifier;

{ ID _o } - a set of reference identifiers of authorized individual entrepreneurs;

ID _ns - identifier of an unauthorized individual entrepreneur;

{ ID _ns } - a set of identifiers of a previously stored unauthorized IP;

IP _o - sender address specified in the identifier of the received message package;

{ IP _oo } - a set of sender addresses specified in the reference identifiers of authorized IPs;

{ IP _l } - a set of false addresses of computer network subscribers;

Z _l - set of sets of information resources;

V _c - a certain sequence of information resources in a specific set;

R _et - a set of reference sets of correspondence between identifiers of unauthorized individual entrepreneurs and sets of information resources;

R _j is a reference set of correspondence between identifiers of unauthorized individual entrepreneurs and a specific set of information resources.

When interacting with sources of unauthorized influences in modern systems of protection against computer attacks, which implement mechanisms for using false addresses, that is, the presence of a false computer network, the structure and functioning of a real computer network is imitated. However, it is more appropriate to use the approach of hiding a real computer network through legendization.

Legend is a method of protecting information from technical intelligence, involving the deliberate dissemination and maintenance of false information about the functional purpose of the object of protection [Doronin A.I. Business intelligence. - 2nd ed., revised. and additional - M.: Publishing house "Os-89", 2003, p. 264].

In this case, the attacker is provided with distorted information about the nature and purpose of the protected information or object, when their presence is not completely hidden, but the actual purpose and nature of the actions are masked [Domarev V.V. Information technology security. Methodology for creating protection systems. - K.: LLC “TID “DS”, 2002, p.639].

Thus, the claimed method assumes the implementation of legendization of the sequence of provision of information resources by generating multiple legends for interaction with unauthorized individual entrepreneurs. In this case, the legend will be a strict sequence of information resources V _c simulating the appearance of an object that is significantly different from the protected computer network. For example, if the protected computer network belongs to a financial organization, then the generated false computer network can imitate a social service, a vocational training organization, or an online store. In this case, the attacker will either actually immediately refuse to carry out the attack due to disinterest in the false object, which can be described as a policy of “scaring away” from the real computer network, or will continue to influence the false object, but in this case it can be considered that the real computer network is not the attacker's target. At the same time, the likelihood of protecting the computer network from external destructive influences increases.

Initially, the initial data is set: reference identifiers of authorized IPs containing the addresses of senders and recipients of message packages; false addresses of computer network subscribers; many sets of information resources; a set of reference sets of correspondence between identifiers of unauthorized individual entrepreneurs and sets of information resources (block 1, Fig. 2).

In this case, a set of sets of information resources is formed Z = { Z _l }, where l is a given number of sets of information resources, Z _l = { V _c }, where V _c is a certain sequence of information resources in a specific set. Each set of information resources is formed both structurally and functionally to support the developed legend, that is, an object that is not related to the real computer network and has a different purpose that is significantly different from the protected computer network.

In addition, many reference sets of correspondence between identifiers of unauthorized individual entrepreneurs and sets of information resources R _et are formed ={ R _j }, where j is a given number of reference sets of correspondence between identifiers of unauthorized individual entrepreneurs and a specific set of information resources. That is, each element K _i belonging to the set of unauthorized IP { ID _ns } is associated with some element Z _l belonging to the set of sets of information resources Z , and it is said that on the set of unauthorized IP { ID _ns } some function R _j with values on a set of sets of information resources Z [Karnakov V.A. Lectures on linear algebra. Tutorial. - Irkutsk 2016, p. 5]. Thus, the reference set of correspondence between identifiers of unauthorized individual entrepreneurs and sets of information resources can be formally written as R _j : K _i → Z _l .

Next, the next packet of messages is received, its legitimacy is determined, and if there is a discrepancy, the message packet ID is assigned the number of occurrence K _i of the received unauthorized IP and this packet is transmitted to the false computer network (block 2-9, Fig. 2).

After transmitting a message packet from an unauthorized IP to the specified false addresses of computer network subscribers and isolating the appearance identifier from themTO _i unauthorized IP is compared with the values in the reference setsR _j correspondence of identifiers of unauthorized individual entrepreneurs to a specific set of information resources (block 10, Fig. 2).

In this case, it is determined whether the appearance of K _i of an unauthorized IP is new or this unauthorized IP is already interacting with a false object or the interaction was previously and there is a reference set R _j of correspondence of identifiers of unauthorized IP to a certain set of information resources with the corresponding record R _j   : K _i → Z _l . This allows interaction to provide the attacker with the same set of information resources describing the legend of a specific false object. To implement a mechanism for determining the correspondence of identifiers of unauthorized IPs to a specific set of information resources, an IP address is used, however, when it is dynamically generated (dynamic records), difficulties will arise associated with the service provider providing access to an external network IP address from an ARP server (free at the time access to the server) [Olifer, V. G. Computer networks. Principles, technologies, protocols (5th edition)./ Olifer, V. G., Olifer N. A. // - St. Petersburg. : Peter, 2016. 992 p.]. To eliminate this drawback, it is proposed to carry out identification not by the full IP address, but by a part of the IP address sufficient to identify a network segment (network location) related to the same ARP server, that is, the same provider, which will allow providing a group of attackers with this segment is a false object with a specifically defined legend.

In accordance with the existing approach, the IP address consists of two logical parts - the network address and the address of the node in the network, while the network address is determined by the mask [Olifer, V. G. Computer networks. Principles, technologies, protocols (5th edition)./ Olifer, V. G., Olifer N. A. // - St. Petersburg. : Peter, 2016. 992 p.], which allows you to use this when comparing the identifier of an unauthorized individual entrepreneur with reference sets R _j . In this case, attackers belonging to a specific segment (network location), regardless of the frequency of impact (a different dynamically generated IP address will be used), will receive the same false object for interaction, which will not arouse their suspicions, which could arise in case of accident. changing the provided set of information resources, and accordingly will avoid opening the used legends.

If the identifiers of unauthorized IP coincide with the values in the reference sets R _j , a set of information resources Z _l is determined corresponding to the manifestation of the unauthorized IP K _i . Then the information resource V _{c + 1} next in the sequence of information resources of the corresponding set of information resource Z _l is determined. Then it is provided for interaction with the corresponding manifestation of the unauthorized IP K _i (blocks 11-13, Fig. 2).

Then the value of the provided information resource V _{c + 1} is compared with the final value of the information resource V _C in this set of information resources Z _l (block 14, Fig. 2). This allows you to sequentially use a set of information resources, which should give the attacker a fairly complete information image of the presented false object.

When the condition V _{c + 1} = V _C is met, the i -th unauthorized IP is blocked and an attack signal on the computer network is generated (block 15, Fig. 2). If the condition is not met, a response message packet is generated from the current information resource and then transmitted to the sender (blocks 19, 20, Fig. 2).

If the identifiers of unauthorized IPs do not match the values in the reference sets R _j, a free set of information resources Z _l is determined and the first information resource V ₁ is provided from it to begin interaction with the corresponding manifestation of the unauthorized IP K _i . A new R _{j +1} reference set of correspondence between identifiers of unauthorized IPs and a specific set of information resources is also formed and stored in a set of reference sets of correspondence between identifiers of unauthorized IPs and sets of information resources R _fl (blocks 16-18, Fig. 2). Next, a response message packet is generated from the current information resource, and then transmitted to the sender (blocks 19, 20, Fig. 2).

Achieving the technical result is explained as follows. In the prototype method, when forming an information resource of a false object, the functioning of a real computer network is imitated, as a result of which this will interest the attacker and will allow him to provide false data, however, there is a possibility in which during the interaction the attacker will determine the elements of the protected computer network and in the future with the development of the computer attacks will have destructive effects on them, which will lead to a significant decrease in the security of the computer network. The claimed method involves the implementation of legendization of the sequence of provision of information resources by generating multiple legends for interaction with unauthorized individual entrepreneurs, by providing distorted information about the nature and purpose of the protected object, when their presence is not completely hidden, but the actual purpose and nature of the actions are masked. At the same time, the legend is a strict sequence of information resources that imitates the appearance of an object that is significantly different from the protected computer network. For example, if the protected computer network belongs to a financial organization, then the generated false computer network can imitate a social service, a vocational training organization, or an online store. In this case, the attacker will either actually immediately refuse to carry out the attack due to disinterest in the false object, which can be described as a policy of “scaring away” from the real computer network, or will continue to influence the false object, but in this case it can be considered that the real computer network is not the attacker's target.

In addition, when organizing interaction with an attacker, actions have been implemented that make it possible to provide a group of attackers of a certain segment, that is, taking into account their network location, a false object with a specifically defined legend, which will not arouse their suspicions, which could arise if the provided set of information is accidentally changed resources, and accordingly will avoid opening the used legends.

Thus, the claimed method, by implementing legendization of the sequence of provision of information resources by generating multiple legends for interaction with unauthorized IPs, taking into account the network location of their sources, makes it possible to increase the security of computer networks.

Claims (1)

A method for protecting computer networks based on legending, which consists in pre-memorizing N ≥1 reference identifiers of authorized information flows containing the addresses of senders and recipients of message packages, setting P ≥1 false addresses of computer network subscribers, receiving the next message package and determining its legitimacy , for which identifiers are extracted from its header, which are compared with the reference identifiers, and if they match, they transmit a legitimate package of messages to the recipient, after which they receive the next package of messages and repeat a set of actions to determine its legitimacy, and if there is no match, they remember the identifiers of the received unauthorized information flow , assign it the next i -th identification number, then transmit a message packet of an unauthorized information flow to the given false addresses of subscribers of the computer network, characterized in that the initial data is additionally specified with many sets of information resources Z ={ Z _l }, where l is a given number sets of information resources, Z _l = { V _c }, where V _c is a certain sequence of information resources in a specific set, available at each P false address of subscribers of the computer network, and also set a set of reference sets of correspondence of identifiers of unauthorized information flows to sets of information resources R _et ={ R _j }, where j is a given number of reference sets of correspondence of identifiers of unauthorized information flows to a certain set of information resources, after transmitting a message package of an unauthorized information flow to the given false addresses of subscribers of a computer network and isolating from them identifiers of the appearance of K _i of an unauthorized information flow, they are compared it with the values in the reference sets R _j of the correspondence of the identifiers of unauthorized information flows to a certain set of information resources and if the identifiers of unauthorized information flows coincide with the values in the reference sets R _j , a set of information resources Z _l is determined corresponding to the manifestation of the unauthorized information flow K _i , after which they are determined information resource V _{c + 1} , next in the sequence of information resources of the corresponding set of information resource Z _l , then provide it for interaction with the corresponding manifestation of the unauthorized information flow K _i , after which the value of the provided information resource V _{c + 1} is compared with the final value of the information resource V _C in a given set of information resources Z _l , and if the condition V _{c + 1} = V _C is met, the i -th unauthorized information flow is blocked and a signal of an attack on the computer network is generated, and if the condition is not met, a response message packet is generated from the current information resource and transmitted to the sender, if the identifiers of unauthorized information flows do not match the values in the reference sets R _j , a free set of information resources Z _l is determined and the first information resource V ₁ is provided from it to begin interaction with the corresponding manifestation of the unauthorized information flow K _i , and also a new R _{j +} is formed ₁ reference set of correspondence of identifiers of unauthorized information flows to a specific set of information resources and store it in a set of reference sets of correspondence of identifiers of unauthorized information flows to sets of information resources R _fl , and then also form a response packet of a message from the current information resource and transmit it to the sender.