WO2009059504A1 - Method and system for defending against tcp attack - Google Patents

Abstract

A method and system for defending against the TCP attack are provided, and the method includes: regarding the messages which have the same source internet protocol IP address, destination IP address, source protocol port number, destination protocol port number, input interface, output interface, protocol type and the flag bit field of transfer control protocol TCP messages as a flow; determining the TCP attack's type by the flag bit field of the flow; and based on the TCP attack's type, defending against the TCP attack. The position and the type of the TCP attack in the network can be located accurately by using the method, and itcan be implemented to dynamically defend against the attack source by interacting with the Netflow analysis process device.

Description

 Method and system for defending against TCP attacks

 The present invention relates to the field of communications technologies, and in particular, to a method and system for defending against a TCP (Transmission Control Protocol) attack. Background technique

 In recent years, with the rapid development of Internet technology, network services have become increasingly abundant, and network traffic has grown rapidly. Traditional extensive traffic statistics management is far from meeting the needs of current business development for network traffic monitoring, network security management, and network monitoring and analysis. The emergence of NetStream technology provides an important basic data platform for the fine management of traffic.

 Netstream is a technology that extracts and analyzes message information on network devices and provides statistics, monitoring, and analysis of network traffic. Netstream technology is based on the concept of "streaming". A stream is a set of four messages that meet the following characteristics: The same source and destination Internet Protocol (IP) addresses, the same source and destination protocol port numbers, have the same In and out interfaces, the same protocol type, and the same service type (ToS). The Netstream stream can record information such as Who, What, When, Where, How in the network. Today, network security is gaining more and more attention. Netstream is also increasingly used to detect and defend against network attacks.

 TCP attacks are a way of cyberattacks. The relatively low-tech content is more difficult to prevent. It is a common method used by network attackers. The basic principle of a TCP attack is: The attacker uses some hosts that have been compromised (including temporary intrusion) to bypass the firewall and make a large number of TCP connection requests to the destination server, so that the destination server is busy responding to these. The request consumes a large amount of storage resources and is exhausted, causing the destination server to refuse execution of normal service requests within the network to achieve the purpose of the attack. Due to this nature of TCP attacks, it is often referred to as a TCP Flood attack.

 When the network is attacked by TCP and the traffic is abnormal, NetStream technology can detect the key information of where the TCP attack traffic comes from and where it goes, effectively defending against attacks by network attackers.

However, in the prior art, the flag of the Netstream-stream is the result of bitwise OR of the flag bit field in all TCP headers. If a TCP message with a flag reset (RST) or a sender byte end (FIN) is received, the stream is aged immediately. When a network attacker sends If a large number of packets are sent to the RST or FIN TCP packets, a packet will be created and aging will occur immediately. A large number of traffic aging and reconstruction will waste the resources of the forwarding engine. Moreover, since Netstream merges the flag bit fields in all the packets, it is impossible to distinguish the specific TCP attack type, which is difficult to meet the requirements of network fine management. Summary of the invention

 The technical problem to be solved by the present invention is to provide a method and system for defending against TCP attacks. The location information and attack type of TCP attacks on the network can be accurately located by collecting the flag information of TCP packets through NetStream.

 In order to solve the above technical problem, the embodiment of the present invention provides a method for defending against a TCP attack, the method comprising: the source Internet protocol IP address, the destination IP address, the source protocol port number, the destination protocol port number, the inbound interface, The outgoing interface, the protocol type, the service type, and the packet with the same flag field of the TCP packet of the Transmission Control Protocol are the same as a flow; the type of the TCP attack is determined by the flag bit field of the flow; Type, defend against the TCP attack.

 Correspondingly, the embodiment of the present invention further provides a system for defending against TCP attacks.

 The system includes a network flow sampling device and a network flow analysis processing device.

 The network flow sampling device is configured to collect network traffic, and the source IP address, the destination IP address, the source protocol port number, the destination protocol port number, the inbound interface, the outbound interface, the protocol type, the service type, and the identifier of the TCP packet. A message with the same bit field as a stream;

 The network flow analysis processing device is configured to process the flow information collected by the network flow sample device, analyze the type of the TCP attack, and defend the TCP attack according to the type of the TCP attack.

 The embodiment of the present invention can accurately locate the location and attack type of the TCP attack in the network, and specifically defend against the TCP attack, thereby avoiding the impact of such attacks on the performance of the network device and the consumption of resources; Linkage, realizing the dynamic defense against the attack source. DRAWINGS

 1 is a schematic flowchart of a method for defending against a TCP attack according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a system for defending against TCP attacks according to an embodiment of the present invention. detailed description In order to make the objects, the technical solutions and the advantages of the embodiments of the present invention more clearly, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

 FIG. 1 is a schematic flowchart diagram of a method for defending against a TCP attack according to an embodiment of the present invention. As shown in Figure 1, the method includes:

 S101: The traffic of the network device is sampled. The following TCP packet with the same information is used as a Netstream stream:

 Source/destination IP address;

 Source/destination port number;

 In/out interface;

 agreement type;

 Service type;

 The flag bit field of the TCP text.

 S102: Store the Netstream stream information.

 S103: Analyze the Netstream flow information, and extract the flag bit field information of the flow.

 The flag bits of the TCP ^艮 text are as follows:

 URG: indicates that the emergency pointer field is valid;

 PSH: indicates that this segment requests a push operation;

 ACK: indicates that the confirmation field is valid;

 SYN: indicates serial number synchronization;

 RST: indicates connection reset;

 FIN: Indicates the end of the sender byte stream.

 If the flag bit field is URG or PSH, execute S104; if the flag bit field is ACK or SYN, execute S105; if the flag bit field is RST or FIN, execute S106.

 S104: The network device stops processing the TCP packet to block the attack source.

 S105: The network device collects statistics on the number of TCP connections and the number of semi-connections, limits the number of TCP connections and the number of semi-connections, or stops processing the TCP packets.

 S106: determining the activity level of the Netstream stream, if the inactive time is less than the set value, executing S107; if the inactive time is greater than the set value, executing S108;

 S107: delay time tl, aging the flow;

S108: delay the time t2, aging the stream. For the TCP packet whose flag is RST or FIN, the embodiment of the present invention does not immediately aging it, but delays it for a period of time, and then ages the stream. Specifically, the inactivity time is used to control the flow aging. The inactive time refers to the time interval from the last discovery of the session to the present time. The inactive time is small, indicating that the flow is active. The delay time of the active stream is longer than the delay time of the inactive stream, that is, the delay time t1 is greater than the delay time t2.

 FIG. 2 is a schematic structural diagram of a system for defending against TCP attacks according to an embodiment of the present invention. As shown in FIG. 2, the system includes a network flow sampling device 1, a network flow collection device 2, and a network flow analysis processing device 3.

 When the network device 4 is attacked by the TCP packet, the network streaming device 1 samples the abnormal traffic in the network device 4, and sends the collected Netstream flow information to the network flow collecting device 2. The Netstream flow information includes: a source/destination IP address, a source/destination port number, an in/out interface, a protocol type, a service type, and a flag bit field of a TCP packet.

 The network stream collecting device 2 receives the Netstream stream information sent by the network stream sampling device 1 and stores it.

 The network flow analysis processing device 3 obtains the collected Netstream flow information from the network flow collection device 2, and after analyzing the Netstream flow information, the location and type of the TCP attack source can be obtained, and the network attack device is obtained. Issue rules/policies that defend against the TCP attack.

 If the flag bit field of the NetStream stream is URG or PSH, the network traffic analysis processing device 3 sends a rule/policy for blocking the attack source to the network device 4, that is, the network device 4 stops processing the TCP packet.

 If the flag bit field of the NetStream stream is ACK or SY, the network traffic analysis processing device 3 sends a rule/policy for counting the number of connections to the network device 4, that is, the number of TCP connections and the number of semi-connections of the network device 4 Statistics are performed to limit the number of TCP connections and the number of semi-connections. The network device 4 can also send rules/policies that block the attack source, that is, the network device 4 stops processing the TCP packets.

 If the flag bit field of the NetStream stream is RST or FIN, the network traffic analysis processing device 3 sends a delay aging rule/policy to the network device 4, that is, the NetStream stream is not immediately aging, but is delayed for a period of time. After that, the Netstream stream is aged.

It can be seen that the technical solution of the embodiment of the present invention can not only accurately locate the location and attack type of the TCP attack in the network, block the attack source, but also prevent the attacker from using the TCP-RST or TCP-FIN text to attack. A large number of rapid aging and re-establishment of the Netstream stream reduces the impact of such attacks on the performance of the network device and the consumption of resources. The linkage with the network flow analysis processing device is implemented. Dynamic defense against attack sources.

 The above are only the preferred embodiments of the present invention, and the scope of the present invention is not limited thereto, and the equivalent changes made by the claims of the present invention are still within the scope of the present invention.

Claims

Rights request  A method for defending against TCP attacks, characterized in that:  The method includes: a source Internet protocol IP address, a destination IP address, a source protocol port number, a destination protocol port number, an inbound interface, an outbound interface, a protocol type, a service type, and a flag field of a transmission control protocol TCP packet. The same message is used as a stream; the type of the TCP attack is determined by the flag bit field of the stream; and the TCP attack is defended according to the type of the TCP attack. 2. The method of claim 1 wherein:  The flag field of the TCP packet includes: an urgent pointer field valid URG, a segment request push operation PSH, an acknowledge field valid ACK, a sequence number synchronization SYN, a connection reset RST, and a sender byte stream end FIN.  3. The method of claim 2, wherein:  If the flag bit field of the stream is URG, PSH, ACK or SYN, the TCP message is stopped. 4. The method of claim 2, wherein:  If the flag bit field of the stream is ACK or SY, the number of TCP connections and the number of semi-joins are limited. 5. The method of claim 2, wherein:  If the flag bit field of the stream is RST or FIN, the flow is aged after being delayed for a period of time. 6. The method of claim 5, wherein:  For an active stream, the delay is longer than the inactive stream delay. 7. The method of claim 6 wherein: An active stream is a stream whose inactive time is less than a set value, and an inactive stream is a stream whose inactive time is greater than a set value. 8. A system for defending against TCP attacks, characterized by:  The system includes a network flow sampling device and a network flow analysis processing device.  The network flow sampling device is configured to collect network traffic, and the source IP address, the destination IP address, the source protocol port number, the destination protocol port number, the inbound interface, the outbound interface, the protocol type, the service type, and the identifier of the TCP packet. A message with the same bit field as a stream;  The network flow analysis processing device is configured to process the flow information collected by the network flow sample device, analyze the type of the TCP attack, and defend the TCP attack according to the type of the TCP attack. 9. The system of claim 8 wherein:  The system further includes a network flow collection device, configured to store the flow information collected by the network flow sample device, and forward the flow information to the network flow analysis processing device.