WO2011000304A1

WO2011000304A1 - Method, device and gateway equipment for detecting abnormal connections

Info

Publication number: WO2011000304A1
Application number: PCT/CN2010/074660
Authority: WO
Inventors: 蒋武; 杨莉
Original assignee: 成都市华为赛门铁克科技有限公司
Priority date: 2009-06-29
Filing date: 2010-06-29
Publication date: 2011-01-06
Also published as: CN101594269A; CN101594269B

Abstract

A method, device and gateway equipment for detecting abnormal connections is disclosed by the embodiments of the present invention. The method includes the following steps: receiving a connection request message sent by a client; establishing a TCP (Transmission Control Protocol) connection with said client; when no data packet is received from said client in a predetermined time, recognizing said TCP connection as an abnormal connection; when a data packet is received from said client in the predetermined time, validating said data packet according to protocol messages; recognizing said TCP connection as a normal connection if the validation is successful, and recognizing said TCP connection as an abnormal connection if the validation is failed. The embodiments of the present invention enable recognizing the TCP connections established with a client as abnormal connections when said client initiates full connection attacks against a server, thus improving accuracy rate for detecting full connection attacks.

Description

The invention relates to a method for detecting abnormal connection, device and gateway device. The application is submitted to the Chinese Patent Office on June 29, 2009, and the application number is 200910151032.0. The invention name is "an abnormal connection detection method, device and gateway device" Priority of Chinese Patent Application, the entire contents of which is incorporated herein by reference.

TECHNICAL FIELD The present invention relates to the field of information security, and in particular, to a method, device, and gateway device for detecting abnormal connections.

Background technique

The Distributed Denial of Service (DDOS) attack uses a reasonable service request to occupy too many service resources, so that the server cannot process the instructions of legitimate users. The TCP full-connection attack in the DD0S attack is to continuously establish a large number of TCP connections with the server through many zombie hosts until the server's connection, memory and other resources are exhausted, causing the server to refuse service and making the server unable to process the instructions of the legitimate user. The feature of the TCP full-connection attack is that it can bypass the protection of the general firewall and achieve the purpose of the attack. For a typical network service system, the number of acceptable TCP connections is limited. When subjected to a TCP full connection attack, the website access is very slow or even inaccessible. In order to realize the detection of the full connection attack, the prior art adopts the connection number judgment method. A firewall or DD0S detection device detects the total number of connections of the protected server. If the total number of connections is greater than the number of connections, the TCP connection is considered abnormal. The connection check module in the firewall or the DD0S detection device detects the TCP connection in the traffic that needs to be defended, and counts the number of successful handshake packets after the TCP connection is completed. After the time period arrives, the statistic value is obtained. When the statistic value is greater than the connection number threshold, the TCP connection is identified as an abnormal connection, that is, there is a full connection attack.

In the process of implementing the present invention, the inventor finds that the normal access traffic changes with time, and when the normal access traffic increases, the number of TCP connections in the traffic also increases, when a certain period of time When the number of TCP connections in the traffic exceeds the connection threshold, the normal TCP connection is recognized as an abnormal connection, that is, it is determined to be a full connection attack, thereby generating a false positive for the full connection attack. Summary of the invention

It is an object of the present invention to provide an abnormal connection detection method, apparatus and gateway device, which can improve the accuracy of detecting a full connection attack.

An embodiment of the present invention provides a method for detecting an abnormal connection, including:

Receiving a connection request message sent by the client;

Establishing a TCP connection with the client;

When the data packet sent by the terminal is not received within the set time, the TCP connection is identified as an abnormal connection;

When the data packet sent by the client is received within the set time, the data packet is verified according to the protocol packet, and if the verification succeeds, the TCP connection is identified as a normal connection, and if the verification fails, the identifier is identified. The TCP connection is an abnormal connection.

The embodiment of the invention further provides an abnormal connection detecting device, comprising:

a transceiver module, configured to receive a connection request message sent by the client, and establish with the client

TCP connection;

a detecting module, configured to detect whether a data packet sent by the client is received within a set time; a verification module, configured to: when the detection result of the detection module is that the data packet sent by the client is received within a set time, verify the data packet according to the protocol packet; The detection result of the detecting module is that when the data packet sent by the client is not received within a set time, the TCP connection is identified as an abnormal connection, and when the verification module successfully verifies the data packet, the The TCP connection is a normal connection, or the TCP connection is identified as an abnormal connection when the verification module fails verification of the data packet. The embodiment of the invention provides a gateway device, which comprises the above abnormal connection detecting device. In the technical solution of the embodiment of the present invention, it is detected whether the data packet sent by the client is received within the set time, and the data packet received within the set time is verified according to the protocol packet, when the client initiates to the server. In the case of a full-connection attack, it is possible to recognize that the TCP connection established with the client is an abnormal connection, thereby improving the accuracy of detecting a full-connection attack.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor. 1 is a flowchart of a method for detecting an abnormal connection according to Embodiment 1 of the present invention;

2 is a flowchart of a method for detecting an abnormal connection according to Embodiment 2 of the present invention; FIG. 3 is a flowchart of a method for detecting an abnormal connection according to Embodiment 3 of the present invention; FIG. 4 is an abnormal connection according to Embodiment 4 of the present invention; FIG. 5 is a flowchart of a method for detecting an abnormal connection according to Embodiment 5 of the present invention; FIG. 6 is a flowchart of a method for detecting an abnormal connection according to Embodiment 6 of the present invention; FIG. 7 is a schematic structural diagram of an abnormal connection detecting apparatus according to Embodiment 7 of the present invention; FIG. 8 is a schematic structural diagram of an abnormal connection detecting apparatus according to Embodiment 8 of the present invention.

detailed description

BRIEF DESCRIPTION OF THE DRAWINGS The technical solutions in the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without departing from the inventive scope are the scope of the present invention. 1 is a flowchart of a method for detecting an abnormal connection according to Embodiment 1 of the present invention. As shown in FIG. 1, the method includes:

Step 1 01: Receive a connection request message sent by the client. Specifically, the connection request message may be a SYN message, and the SYN (synchron i ze) message is a handshake signal used when the TCP/IP establishes a connection.

Step 1 02: Establish a TCP connection with the client. Specifically, after receiving the SYN message sent by the client, the client returns a SYN-ACK message, and the client sends an ACK message as a response, thereby completing the process of establishing a TCP connection. . The SYN-ACK message is a response message to the SYN message, and the ACK message is a response message to the SYN-ACK message. In this step, after receiving the SYN message, the SYN message is not forwarded to the server, but a TCP connection is established with the client. Step 1 03. Check whether the data packet sent by the client is received within the set time. If yes, go to step 1 04. Otherwise, go to step 1 06. The set time can be any preset time period.

Step 1 04: Verify the data packet according to the protocol packet, and if the verification succeeds, execute the step. Step 105, if the verification fails, step 106 is performed;

In this embodiment, the protocol packets may be h 1 p protocol packets, f t p protocol packets, and s sh protocol packets, depending on the actual application.

Specifically, the content of the data packet is consistent with the protocol packet type. If the content of the data packet is consistent with the protocol packet type, the verification succeeds. If the content of the data packet does not match the protocol packet type, the verification fails.

Step 105: Identify the TCP connection as a normal connection;

If the verification succeeds, the received data packet is considered to be a normal data packet, and the TCP connection is a normal connection, that is, the client does not perform a full connection attack on the server.

Step 106: Identify that the TCP connection is an abnormal connection.

If no packet is received within the set time, the TCP connection is identified as an abnormal connection, that is, the client performs a full connection attack on the server.

In the technical solution of the embodiment, it is detected whether the data packet sent by the client is received within the set time, and the data packet received within the set time is verified according to the protocol packet, when the client initiates the full message to the server. When the connection is attacked, the TCP connection established with the client can be identified as an abnormal connection, thereby improving the accuracy of detecting the full connection attack.

FIG. 2 is a flowchart of a method for detecting an abnormal connection according to Embodiment 2 of the present invention. As shown in FIG. 2, the method includes:

Step 201: Receive a connection request message sent by the client, where the connection request message carries client address information.

The steps in this embodiment may be performed by the detecting device of the abnormal connection. Specifically, when the client sends a connection request message to the server, the detecting device of the abnormal connection receives the connection request message. Step 202, it is determined whether the set record table includes client address information, if yes, step 208 is performed, otherwise step 203 is performed;

The record table stores trusted client address information and untrusted (or malicious) client address information. The trusted client address information is the authenticated client address information, and the untrusted client address information is Unverified client address information. In the actual application, the record table may include a whitelist and a blacklist. The whitelist stores trusted client address information, and the list contains malicious client address information.

Step 203: Establish a TCP connection with the client.

Specifically, after the detecting device that the abnormal connection receives the connection request message sent by the client, if the client address information carried in the connection request message is determined to be unfamiliar address information according to the set record table, the detecting device replaces The server establishes a TCP connection with the client.

Step 204, detecting whether the data packet sent by the client is received within the set time, if yes, executing step 205, otherwise performing step 207;

Specifically, in the case of a normal connection, after the abnormal connection detection device establishes a TCP connection with the client, the client sends a data packet to the abnormally connected detection device, and therefore, the abnormal connection detection device can detect whether it is set Check whether the data packet sent by the client is received within a certain period of time to initially determine whether the TCP connection is an abnormal connection.

Step 205: The data packet is verified according to the protocol packet. If the verification is successful, step 206 is performed. If the verification fails, step 207 is performed;

Specifically, the verification of the data packet according to the protocol 4 may be performed to verify whether the content of the data packet is consistent with the protocol packet. If the content of the data packet is consistent with the protocol packet, the verification succeeds, if the content of the data packet and the protocol report are successful. The verification fails if the text is inconsistent. Step 206: Identify the TCP connection as a normal connection, store the client address information in the set record table, disconnect the TCP connection established with the client, and the process ends.

Specifically, the client address information is stored in the trusted client address information in the record table. Step 207: Identify the TCP connection as an abnormal connection, store the client address information in the set record table, discard the TCP connection, and the process ends.

Specifically, the client address information is stored in the malicious client address information in the record table. Step 208: Allow or deny the client to establish a TCP connection with the server, and the process ends.

Specifically, when it is determined that the trusted client address information includes the client address information, that is, the client address information is trusted client address information, the client is allowed to establish a TCP connection with the server, and the abnormal connection is performed at this time. The detecting device forwards the connection request message sent by the client to the server, so that the client establishes a TCP connection with the server; when it is determined that the malicious client address information includes the client address information, the client address information is a malicious client. In the address information, the client is denied a TCP connection with the server. At this time, the detecting device of the abnormal connection rejects the connection request of the client, thereby protecting the server from the TCP full connection attack.

In the technical solution of the embodiment, it is detected whether the data packet sent by the client is received within the set time, and the data packet received within the set time is verified according to the protocol packet, when the client initiates the full message to the server. When the connection is attacked, the TCP connection established with the client is recognized as an abnormal connection in time, thereby improving the accuracy and real-time performance of detecting the full connection attack.

FIG. 3 is a flowchart of a method for detecting an abnormal connection according to Embodiment 3 of the present invention. As shown in FIG. 3, the method includes:

Step 301: Receive a connection request message sent by the client, where the connection request message carries port information and client address information. Each step in this embodiment may be performed by an abnormally connected detecting device;

The port information may be an HTTPS port or the like, and the port information may use the default port information or the user-defined port information; the client address information may be the IP address of the client.

Step 302: Parse the protocol type from the port information carried in the connection request message. For example, the detecting device of the abnormal connection detects that the port is an HTTPS port according to the port information, so that the data packet is parsed into an HTTPS protocol type data packet, HTTPS. The protocol is a network protocol built by SSL and HTTP protocol for encrypted transmission and identity authentication. SSL is a protocol that encrypts and decrypts data in a secure connection between a client and an SSL-enabled server.

Step 303: Query whether the pre-configured protocol type to be detected includes the identified protocol type, if yes, go to step 304, otherwise go to step 313;

Specifically, because the pre-configured protocol type to be detected may include one or more protocols, it may be queried whether the identified protocol type of the data packet belongs to a range to be detected.

In step 304, it is determined whether the client address information is included in the whitelist and the blacklist. If the client address information is not included in the whitelist and the blacklist, step 305 is performed; if the whitelist includes the client address information, the process is performed. Step 313; If the blacklist includes client address information, step 314 is performed;

Specifically, in order to improve the quality of the detection, a whitelist and a blacklist can be set at the same time. The client address information set in the whitelist is the client address information that is allowed to pass, and the client address information set in the blacklist is the client address information that is rejected. Of course, those skilled in the art can know that setting a whitelist and a blacklist at the same time is only a better implementation manner, and it is also possible to set only a whitelist or only a blacklist. Step 305, establishing a TCP connection with the client, proceeds to step 306;

Step 306, detecting whether the data packet sent by the client is received within the set time, if yes, executing step 307, otherwise performing step 310;

Step 307: Perform verification on the data packet according to the protocol packet, if the verification is successful, execute step 308; if the verification fails, perform step 31 0;

Specifically, the content of the data packet is consistent with the protocol packet. If the content of the data packet is consistent with the protocol packet, the verification succeeds. If the content of the data packet is inconsistent with the protocol packet, the verification fails.

Step 308, identifying the TCP connection as a normal connection, proceeds to step 309;

Step 309: Add the client address information to the whitelist, and send a disconnect message to the client, and the process ends.

The disconnect message can be an RST message.

Step 310: Identify the TCP connection as an abnormal connection, and proceed to step 31 1;

Step 311: Discard the TCP connection, dry the resources occupied by the TCP connection, and proceed to step 312. Step 312: Add the client address information to the blacklist, and the process ends.

Step 31 3. Allow the client to establish a TCP connection with the server, and the process ends.

Step 314: Reject the client to establish a TCP connection with the server, and the process ends.

It can be understood that, in this embodiment, after the TCP connection is identified as being abnormally connected, step 312 may be performed to add the client address information to the blacklist, and then step 311 is performed to discard the TCP connection, and the resources occupied by the TCP connection are released.

In this embodiment, after the TCP connection is identified as being abnormally connected, only step 31 1 may be performed, the TCP connection is discarded, and the resources occupied by the TCP connection are released, and step 312 is not performed, that is, the client is not The terminal address information is added to the blacklist. Alternatively, in this embodiment, the whitelist is not set, and the blacklist is not set. After the step 31 is performed, the step of adding the client address information to the blacklist in step 312 is not performed. . In this way, when the client requests to establish a TCP connection again, each step in this embodiment needs to be performed to identify that the TCP connection of the client is an abnormal connection. In this case, the detecting device of the abnormal connection needs to continuously establish a TCP connection with the client, and repeatedly performs a process of detecting that the TCP connection is an abnormal connection. In fact, this situation is the case where the abnormally connected detection device replaces the server to withstand the client's initiation of a full connection attack.

4 is a flowchart of a method for detecting an abnormal connection according to Embodiment 4 of the present invention. This embodiment is mainly applied to a case where the protocol type is the FTPS protocol. As shown in FIG. 4, the method includes:

Step 401: Receive a connection request message sent by the client, where the connection request message carries port information and client address information.

The steps in this embodiment can be performed by an abnormally connected detecting device.

Step 402: Parse the protocol type from the port information carried in the connection request message. Specifically, in this embodiment, the protocol type is an FTPS protocol type. FTPS is an enhanced TFP protocol that uses standard FTP protocols and commands at the Secure Sockets Layer to add SSL security to the FTP protocol and data channels. FTPS is also known as "FTP-SSL" and "FTP-over-SSL".

Step 403: Query whether the pre-configured protocol type includes the identified protocol type, if yes, execute step 404, otherwise perform step 415; In step 404, it is determined whether the client address information is included in the whitelist and the blacklist. If the client address information is not included in the whitelist and the blacklist, step 405 is performed; if the whitelist includes the client address information, Go to step 41 5; if the blacklist includes client address information, go to step 416;

Step 405: Establish a TCP connection with the client.

Step 406: Detect whether the data packet sent by the client is received in the silent time, if yes, go to step 412, otherwise go to step 407;

The silence time can be any set time. In the FTPS protocol type, after establishing a TCP connection with the client, during the set silence time, the client does not actively send any data packets to the abnormally connected detection device under normal conditions. Therefore, the silent time is passed in this step. It is also possible to determine whether the client that sent the packet is a trusted client by detecting whether the packet sent by the client is received.

Step 407: Send a version data packet to the client, and proceed to step 408;

Specifically, under the FTPS protocol type, the client does not send a data packet to the peer device (the peer device that establishes a TCP connection with the client) in the set silent time, but only receives the version sent by the peer device. After the data packet, the data packet will be sent to the peer device according to the version data packet. In this embodiment, if the client needs to send a data packet to the abnormally connected detecting device, it needs to first receive the FTPS version data packet sent by the abnormally connected detecting device.

Step 408: Detect whether the data packet sent by the client is received within the set time, if yes, go to step 409; if otherwise, go to step 412;

Specifically, after the abnormally connected detecting device sends the version data packet to the client, it detects whether the data packet sent by the client is received within the set time, and if yes, performs step 409; otherwise, step 412 is performed. Step 409: Perform verification on the data packet according to the protocol packet, if the verification is successful, execute step 41 0; if the verification fails, perform step 412;

Step 410: Identify the TCP connection as a normal connection, and proceed to step 41 1;

Step 411: Add the client address information to the whitelist, and send a disconnect message to the client, and the process ends.

The disconnect message can be an RST message.

Step 412: Identify the TCP connection as an abnormal connection, and proceed to step 41 3;

Step 41 3. Discard the TCP connection and release the resources occupied by the TCP connection, and go to step 414. Step 414: Add the client address information to the blacklist, and the process ends.

Step 415: Allow the client to establish a TCP connection with the server, and the process ends.

Step 416: Reject the client to establish a TCP connection with the server, and the process ends.

The following describes the application of the abnormal connection detection method of the present invention to the HTTPS protocol by using a specific embodiment. The HTTPS protocol is a network protocol that can be encrypted and transmitted by SSL and the ht tp protocol. In this embodiment, the client is an HTTPS client, and the server is an HTTPS server. The process in this embodiment describes the connection request sent by the client. The full connection attack detects and detects that the established TCP connection is a normal connection. The detection of the full connection attack in the embodiment may be performed by the detecting device of the abnormal connection. The detecting device of the abnormal connection may be deployed separately or in the gateway device. Therefore, in this embodiment, the detecting device includes the abnormal connection. The gateway device is used as an example to describe the detection method of the abnormal connection. FIG. 5 is a flowchart of a method for detecting an abnormal connection according to Embodiment 5 of the present invention. As shown in FIG. 5, the method includes:

Step 501: The client sends a SYN message to the gateway device, where the SYN message carries the HTTPS port information and the IP address of the HTTPS client.

Step 502: The gateway device parses the HTTPS port information carried by the SYN message from the HTTPS protocol, and queries the pre-configured protocol type to include the HTTPS protocol.

That is, the identified HTTPS protocol belongs to the scope of full connectivity attack detection.

The HTTPS port information can be the default port 443 or user-defined port information.

Step 503: The gateway device determines that the set whitelist and the blacklist do not include the IP address information of the client.

Step 504: The gateway device sends a SYN-ACK message to the HTTPS client.

Step 505: The HTTPS client returns an ACK message to the gateway device.

Thus the HTTPS client establishes a TCP connection with the gateway device.

Step 506: Add an IP address of the HTTPS client to the aging table, and set an aging time, where the aging time is a set time.

Step 507: The gateway device receives the data packet sent by the HTTPS client in the aging time. Step 508: The gateway device verifies and validates the data packet according to the HTTPS protocol packet. The HTTPS protocol packet may be the He in the HTTPS protocol. l lo message. The gateway device can verify the received data packet according to the Hello message. If the data packet is consistent with the Hello message, the verification succeeds; if the data packet is inconsistent with the Hello message, the verification fails. In other words, in the case that the verification is successful, the data packet sent by the HTTPS client is the Hello message. Step 509, the gateway device recognizes that the TCP connection is a normal connection, and adds the address information of the HTTPS client to the whitelist.

Step 510: The gateway device returns an RST message to the HTTPS client to disconnect the TCP connection with the HTTPS client.

Step 511: The HTTPS client sends a SYN message to the HTTPS server through the gateway device. The gateway device queries the whitelist to include the IP address of the client carried in the SYN message, and then forwards the SYN message to the HTTPS server.

Step 512: The HTTPS server sends a SYN-ACK message to the HTTPS client through the gateway device. Step 51 3. The HTTPS client returns an ACK message to the HTTPS server through the gateway device, thereby establishing a TCP connection with the HTTPS server.

Step 514: The HTTPS client performs HTTPS data transmission through the gateway device and the HTTPS server.

In this embodiment, if the gateway device verifies the data packet according to the HTTPS protocol and fails the verification, the TCP connection is identified as an abnormal connection, and the IP address of the client is added to the blacklist. When the HTTPS client re-directs When the HTTPS server sends a SYN message, the gateway device will refuse to establish a TCP connection between the HTTPS client and the HTTPS server.

The method for detecting the abnormal connection of the present invention is applied to the FTPS protocol in detail by using a specific embodiment. In this embodiment, the client is an FTPS client and the server is an FTPS server. The process in this embodiment describes the client. The connection request sent by the terminal performs a full connection attack check. Measure and detect the established TCP connection as a normal connection. The detection of the full connection attack in the embodiment may be performed by the detecting device of the abnormal connection. The detecting device of the abnormal connection may be deployed separately or in the gateway device. Therefore, in this embodiment, the detecting device includes the abnormal connection. The gateway device is used as an example to describe the detection method of the abnormal connection. FIG. 6 is a flowchart of a method for detecting an abnormal connection according to Embodiment 6 of the present invention. As shown in FIG. 6, the method includes:

Step 601: The FTPS client sends a SYN message to the gateway device, where the SYN message carries the FTPS port information and the IP address of the FTPS client.

Step 602: The gateway device parses the protocol type of the FTPS port information carried by the SYN message into the FTPS protocol, and queries the pre-configured protocol type to include the FTPS protocol.

That is, the identified FTPS protocol belongs to the scope of full connectivity attack detection.

The FTPS port information can be the default port 21 or user-defined port information.

Step 603: The gateway device determines that the set whitelist and the blacklist do not include the IP address information of the client.

Step 604: The gateway device sends a SYN-ACK message to the FTPS client.

Step 605: The FTPS client returns an ACK message to the gateway device.

Thus, the FTPS client establishes a TCP connection with the gateway device.

Step 606: The gateway device adds the IP address of the FTPS client to the aging table, and sets the aging time, where the aging time is the silent time.

Step 607: The gateway device detects, in the aging time, that the data packet sent by the FTPS client is not received.

Step 608: The gateway device sends a version data packet f tp vers i on to the FTPS client. Ftp ve rsi on is the data packet in the FTPS protocol;

Step 609: The gateway device presets a set time.

Step 610: The gateway device receives the data packet sent by the FTPS client within the set time. Step 611: The gateway device verifies and verifies the data packet according to the FTPS protocol packet. The FTPS protocol is used in the FTPS protocol. USER Command message;

The gateway device can verify the received data packet according to the USER Co and message. If the data packet is consistent with the USER Command message, the certificate is successful. If the data packet is inconsistent with the USER Command message, the verification fails. In other words, in the case of successful authentication, the packet sent by the FTPS client is the USER Command message.

Step 612: The gateway device identifies that the TCP connection is a normal connection, and adds the address information of the FTPS client to the whitelist.

Step 61: The gateway device returns an RST message to the FTPS client to disconnect the TCP connection with the HTTPS client.

Step 614: The FTPS client sends a SYN message to the FTPS server through the gateway device; the gateway device queries the whitelist including the IP address of the client carried in the SYN message.

The SYN message is forwarded to the FTPS server.

Step 615: The FTPS server sends a SYN-ACK message to the FTPS client through the gateway device. Step 616: The FTPS client returns an ACK message to the FTPS server through the gateway device, so as to establish a TCP connection with the FTPS server.

Step 617: The FTPS client performs FTPS data transmission through the gateway device and the FTPS server. In this embodiment, if the gateway device verifies the data packet according to the FTPS protocol packet and fails the verification, the TCP connection is identified as an abnormal connection, and the IP address of the client is added to the blacklist. When the FTPS client sends a SYN message to the FTPS server again, the gateway device will refuse to establish a TCP connection between the FTPS client and the FTPS server.

In this embodiment, if the gateway device detects that the data packet sent by the FTPS client is received during the aging time (that is, the quiet time), the gateway device identifies the TCP connection as an abnormal connection, and adds the IP address of the client to the blacklist. When the FTPS client resends the SYN message to the FTPS server, the gateway device will refuse to establish a TCP connection between the FTPS client and the FTPS server.

FIG. 7 is a schematic structural diagram of an abnormal connection detecting apparatus according to Embodiment 7 of the present invention. As shown in FIG. 7, the abnormal connection detecting apparatus includes a transceiver module 111, a detecting module 112, a verifying module 11 3, and an identifying module 114, wherein :

The transceiver module 11 1 is configured to receive a connection request message sent by the client, and establish a connection request message with the client.

TCP connection;

Specifically, the transceiver module 11 1 sends a connection request message sent by the client, sends a connection response message to the client, and receives a response message returned by the client, and establishes a TCP connection with the client. The connection request message may be a SYN message, the connection response message may be a SYN-ACK message, and the response message may be an ACK message.

The detecting module 112 is configured to detect whether the data packet sent by the client is received in the set time; specifically, the detecting module 112 sends the detection result that detects the data packet sent by the client to the verification module 113, or The detection result of detecting that the data packet sent by the client is not received is sent to the identification module 114. It can be understood that the data packet sent by the client can be received by the transceiver module 111.

The verification module 11 3 is configured to: when the detection module 112 detects that the data packet is received, verify the received data packet according to the protocol packet; Specifically, the verification module 133 can verify whether the content of the data packet is consistent with the protocol packet type. If the content of the data packet is consistent with the protocol packet type, the verification succeeds. If the content of the data packet is inconsistent with the protocol packet type, The verification failed.

The identification module 114 is configured to identify that the TCP connection is an abnormal connection when the detection module 112 detects that the data packet is not received, and identify the TCP connection as a normal connection when the verification module 113 successfully verifies the data packet. Or identifying the TCP connection as an abnormal connection when the verification module 113 fails the verification of the data packet.

Specifically, the identification module 114 may identify that the TCP connection is an abnormal connection according to the detection result of the detection module 112. It is also possible to identify whether the TCP connection is an abnormal connection according to the verification result of the verification module 113. Specifically, when the verification result of the verification module 112 is that the verification is successful, the TCP connection is identified as a normal connection, and when the verification module 1 13 is verified. The result is that the TCP connection is identified as an abnormal connection when the validation fails.

In the technical solution of the embodiment, the abnormal connection detecting device may detect whether the data packet sent by the client is received within a set time, and verify the data packet received within the set time according to the protocol packet, when the When the client initiates a full-connection attack to the server, the detecting device of the abnormal connection can recognize that the TCP connection established with the client is an abnormal connection, thereby improving the accuracy of detecting the full-connection attack.

FIG. 8 is a schematic structural diagram of an abnormal connection detecting apparatus according to Embodiment 8 of the present invention. As shown in FIG. 8, the abnormal connection detecting apparatus in this embodiment adds a judging module 115 to the embodiment in the figure. The first processing module 116 and the second processing module 117. Specifically, in the embodiment of the present invention, the transceiver module 1 11 includes a first transceiver sub-module 1 11 1 and a second transceiver sub-module 1112, and the judging module 115 includes a first judgment. a submodule 1151 and a second judging submodule 1152, wherein:

The first transceiver sub-module 1111 is configured to receive a connection request message sent by the client, where the connection is requested The message carries the client port number information and the client address information;

a first judging sub-module 1151, configured to determine, according to the set record table, whether the protocol type of the connection request message is included in the protocol type to be detected, and if yes, triggering the second judging sub-module 1152, otherwise triggering the first processing module 116 ;

Specifically, the protocol type of the connection request message can be obtained by parsing the client port number information carried in the connection request message. The set record table contains protocol type information to be detected, trusted client address information, and untrusted client address information.

The second judging sub-module 1152 is configured to determine, according to the address information in the set record table, whether the client address information is included, if yes, the first processing module 116 is triggered, otherwise the second transceiver module 11 12 is triggered;

Specifically, the record table stores trusted client address information and untrusted (or malicious) client address information, and the trusted client address information is authenticated client address information, and the untrusted client The address information is the client address information that has not been verified. In the actual application, the record table may include a whitelist and/or a blacklist. The whitelist stores trusted client address information, and the blacklist stores malicious client address information.

a second transceiver module 1112, configured to establish a TCP connection with the client, and trigger a detection module

113 ;

That is to say, at this time, the detecting device of the abnormal connection replaces the server to establish a TCP connection with the client, thereby starting the full certificate process for the client.

The detecting module 112 is configured to detect whether the data packet sent by the client is received within the set time, and if yes, trigger the verification module 11 3, otherwise trigger the identification module 114;

Specifically, in the case of a normal connection, the detecting device of the abnormal connection establishes a TCP with the client. After the connection, the client sends a data packet to the abnormally connected detecting device. Therefore, the detecting module 112 can determine whether the TCP connection is abnormally connected by detecting whether the data packet sent by the client is received within the set time.

The verification module 11 3 is configured to verify the data packet sent by the client within the set time according to the protocol packet.

Specifically, the verification of the data packet according to the protocol 4 may be performed to verify whether the content of the data packet is consistent with the protocol packet. If the content of the data packet is consistent with the protocol packet, the verification succeeds, if the content of the data packet and the protocol report The verification fails if the text is inconsistent.

The identification module 114 is configured to verify the verification result of the module 11 3 and the detection result of the detection module 112 to identify whether the TCP connection is an abnormal connection, and trigger the second processing module 117;

Specifically, when the result of the detection result 112 is that the data packet sent by the client is not received within the set time, the TCP connection is identified as an abnormal connection; when the verification result of the verification module 11 is a verification failure, the TCP connection is identified. For abnormal connection; when the verification result of the verification module 113 is that the verification is successful, the TCP connection is identified as a normal connection.

The first processing module 116 is configured to perform corresponding processing on the connection request message according to the determination result of the first determining sub-module 1 151 and the determination result of the second determining sub-module 1152;

Specifically, when the first determining sub-module 1151 determines, according to the set record table, that the protocol type of the data packet is not the protocol type to be detected, the connection request message is sent to the server, so that the server establishes a TCP connection with the client; When the second judgment sub-module 1152 determines that the client address information is trusted client address information according to the set record table, the connection request message is sent to the server, so that the server establishes a TCP connection with the client; When the module 1 152 determines that the client address information is trusted client address information according to the set record table, the connection of the client is rejected. Ask for news.

The second processing module 1 is configured to: when the identification module 114 recognizes that the TCP connection is a normal connection, store the client address information in the set record table, and disconnect the TCP connection; when the identification module 11 recognizes When the TCP connection is abnormally connected, the client address information is stored in the set record table, and the TCP connection is discarded.

Specifically, when the TCP connection is recognized as a normal connection, the RST message may be returned to the client, and the TCP connection of the client is rejected; when the TCP connection is identified as an abnormal connection, the TCP connection is discarded, thereby protecting the server from the server. The client's full connection attack.

It can be understood that the judging module 1 15 can also include only the second judging sub-module 1152. The first processing module 116 and the second processing module 117 can be one module.

It can be understood that, for the f tp type data packet, the detecting module 112 can further detect whether the data packet sent by the client is received in the silent time, and send the detection result of the data packet received in the silent time to the detection result. The identification module 114 identifies that the TCP connection is an abnormal connection by the identification module 114; or the detection module 112 sends the detection result that the data packet is not received in the silent time to the transceiver module 111, and the transceiver module 11 1 sends the version data to the client. The packet is detected by the detecting module 12 12 within a set time whether the data packet sent by the client is received.

The technical solution of the embodiment of the present invention can be applied to detecting a full connection attack of multiple protocol types. Test, including HTTP, HTTPS, FTP, FTPS or SSH protocol types.

It should be noted that the detecting device for abnormal connection in the embodiment of the present invention may be separately set or may be set in various gateway devices, such as a firewall, an anti-DDOS device, and a unified threat management (Uniformed Threa t Management, referred to as UTM). The device or the Intrusion Prevention System (IPS) device, etc., will not be described in detail.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to be limiting, although the present invention will be described in detail with reference to the preferred embodiments. The technical solutions of the present invention may be modified or equivalently substituted, and the modified technical solutions may not deviate from the spirit and scope of the technical solutions of the present invention.

Claims

Rights request

A method for detecting an abnormal connection, comprising:

Receiving a connection request message sent by the client;

Establishing a TCP connection with the client;

When the data packet sent by the client is not received within the set time, the TCP connection is identified as an abnormal connection;

2. The method according to claim 1, wherein the verifying the data packet according to the protocol packet comprises:

Verify that the content of the data packet is consistent with the protocol packet. If they are consistent, the verification succeeds. Otherwise, the insurance certificate fails.

The method according to claim 1, wherein the connection request message carries client address information;

After the receiving the connection request message sent by the client, the method further includes:

Determining whether the client address information is included in the set record table;

When the client address information is not included in the record table, performing the step of establishing a TCP connection with the client; or

When the client address information is included in the record table, if the client address information is determined to be trusted client address information according to the record table, the connection request message of the client is sent to a server that causes the client to establish a TCP connection with the server; The table determines that the client address information is untrusted client address information, and rejects the connection request of the client.

4. The method according to claim 3, further comprising:

When the TCP connection is identified as being abnormally connected, the client address information is stored in the record table, and the TCP connection is discarded;

When the TCP connection is identified as a normal connection, the client address information is stored in the record table, and the TCP connection established with the client is disconnected.

The method according to claim 1, wherein the connection request message carries the port information and the client address information; the receiving the connection request message sent by the client further comprises: carrying the connection request message Parsing the protocol type in the port information;

Query whether the pre-configured protocol type to be detected includes the parsed protocol type, and if yes, continue to determine whether the set record table includes the client address information, and when the record table Zhennanguan does not include the When the client address information is used, the step of establishing a TCP connection with the client is performed.

6. An abnormally connected detecting device, comprising:

a transceiver module, configured to receive a connection request message sent by the client, and establish a TCP connection with the client;

a detecting module, configured to detect whether a data packet sent by the client is received within a set time; and a verification module, configured to: when the detection result of the detecting module is received by the client within a set time In the case of a data packet, the data packet is verified according to the protocol packet;

An identification module, configured to identify that the TCP connection is an abnormal connection when the detection result of the detection module is that the data packet sent by the client is not received within a set time, when the verification module is The TCP connection is identified as a normal connection when the packet verification is successful, or the TCP connection is identified as an abnormal connection when the verification module fails to verify the data packet.

The device according to claim 6, further comprising a judging module; the transceiver module comprises a first transceiver sub-module and a second transceiver sub-module;

The first transceiver module is configured to receive the connection request message, where the connection request message carries client address information;

The determining module is configured to determine, in the set record table, whether the client address information carried by the connection request message received by the first transceiver submodule is included, and when the client address information is not included in the record table, Triggering the second transceiver submodule;

The second transceiver module is configured to establish a TCP connection with the client when the determining module determines that the determination result of the client address information is not included in the record table.

8. The device according to claim 7, further comprising:

a first processing module, configured to: when the determining module determines that the client address information is included in the record table, if the client address information is determined to be trusted client address information according to the record table, Sending the connection request message of the client to the server, so that the client establishes a TCP connection with the server; if the client address information is determined to be untrusted client address information according to the record table, the client is rejected End connection request.

9. The device according to claim 7, further comprising:

a second processing module, configured to: when the identification module recognizes that the TCP connection is a normal connection, store the client address information in the set record table, and disconnect the TCP connection; when the identification module identifies the TCP connection When the connection is abnormal, the client address information is stored in the set record table, and the TCP connection is discarded.

A gateway device, comprising: the abnormal connection detecting device according to any one of claims 6 to 9.