WO2024002067A1 - Attack tracing method and apparatus, and router, server and storage medium - Google Patents

Abstract

An attack tracing method and apparatus, and a router, a server and a storage medium. The attack tracing method comprises: acquiring a data packet, wherein the data packet is sent from an attack source device to an attacked device (S110); and marking the data packet to obtain a marked data packet, such that the attacked device traces the attack source device according to a target data packet (S120), wherein the target data packet is a marked data packet which is obtained after the data packet is finally marked.

Description

Attack source tracing methods, devices, routers, servers and storage media Technical field

This application relates to the field of communication technology, such as attack source tracing methods, devices, routers, servers and storage media.

Background technique

With the increase in access demand, the Internet of Everything has caused a significant increase in the number of IoT devices directly exposed to cyberspace. A large number of IoT devices with security vulnerabilities are easily attacked by hackers, thereby forming a botnet to launch large-scale distributed denial of service (DDoS) attacks.

Software Defined Network (SDN) is a new network architecture that separates the control plane and data plane to support network virtualization. Due to its many advantages such as flexible structure, easy deployment, programmability, scalability, and decoupling, it provides a new method for mitigating DDoS attacks. However, most DDoS attack defense solutions in SDN analyze local traffic characteristics in a single network domain for centralized single-point detection, and achieve DDoS attack mitigation by blocking DDoS attack traffic. In actual practice, many IoT devices targeted by DDoS attacks are usually located within the jurisdiction of different controllers. That is, DDoS attacks usually target IoT devices in multiple network domains.

Related technology provides a DDoS attack source tracing method based on log recording. The main idea of this method is that when a data packet is transmitted in the network, the router records the information of the data packet and stores it in the routing log. When the attacked IoT device detects that it has been attacked, it sends a query request to the upstream router. According to the path log in the router, it uses a recursive method to find out the router that the data packet passes through, obtains the attack route, and finds the attack based on the attack route. source.

However, related technical solutions have the following shortcomings: first, the router is required to record a large amount of data information, which increases the router's overhead and reduces the router's performance; second, due to the limited storage capacity of the router, it cannot store data unlimitedly; when the router When the storage reaches the upper limit, the log records will be refreshed, and the traceability of the attack source can only be completed within a certain time limit; thirdly, the log records have security risks. If the router is controlled by an attacker, the attacker can modify or delete the log records at will, making it impossible to trace back. Source of attack.

Contents of the invention

This application provides attack source tracing methods, devices, routers, servers, and storage media to solve the problems in related technologies such as excessive router overhead, limited storage capacity, and inability to accurately trace the attack source.

This application provides an attack source tracing method applied to routers, including:

Obtain a data packet, which is sent from the attack source device to the attacked device; mark the data packet to obtain a marked data packet, so that the attacked device can trace the attack source device according to the target data packet, The target data packet is a marked data packet obtained after final marking of the data packet.

This application also provides an attack source tracing method, which is applied to the server. The method includes:

When an attack is detected, the target data packet is extracted. The target data packet has complete label information. The complete label information includes all autonomous system (Autonomous System, AS) domains between the attack source device and the attacked device. Autonomous system number; reconstruct the AS path between the attack source device and the attacked device according to the fragment storage field in the target data packet; trace the attack source device according to the AS path.

This application also provides an attack source tracing device, applied to routers, including:

The acquisition module is configured to acquire data packets, and the data packets are sent from the attack source device to the attacked device; the marking module is configured to mark the data packets to obtain the marked data packets, so that the attacked device can obtain marked data packets according to the target data. The packet traces back to the attack source device, and the target data packet is a marked data packet obtained after final marking of the data packet.

This application also provides an attack source tracing device, applied to the server, including:

The extraction module is configured to extract the target data packet when a distributed denial of service attack is detected. The target data packet has complete mark information, and the complete mark information includes all ASs between the attack source device and the attacked device. The autonomous system number of the domain; the reconstruction module is configured to reconstruct the AS path between the attack source device and the attacked device based on the fragment storage field in the target data packet; the traceback module is configured to reconstruct the AS path between the attack source device and the attacked device based on The AS path traces the attack source device.

This application also provides a router, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the above attack tracing method is implemented.

This application also provides a server, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the above attack tracing method is implemented.

This application also provides a storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the above-mentioned attack traceability method is implemented.

Description of drawings

Figure 1 is a schematic diagram of an SDN architecture provided by an embodiment of this application;

Figure 2 is a schematic flow chart of an attack source tracing method provided by an embodiment of the present application;

Figure 3 is a schematic diagram of rewriting the IP header of a data packet into a preset mark area according to an embodiment of the present application;

Figure 4 is a flow example diagram of another attack source tracing method provided by an embodiment of the present application;

Figure 5 is a schematic flow chart of another attack source tracing method provided by an embodiment of the present application;

Figure 6 is a schematic diagram of AS path reconstruction in an attack source tracing method provided by an embodiment of the present application;

Figure 7 is a schematic diagram of an attack mitigation process provided by an embodiment of the present application;

Figure 8 is an example flow chart of another attack source tracing method provided by an embodiment of the present application;

Figure 9 is a schematic structural diagram of an attack source tracing device provided by an embodiment of the present application;

Figure 10 is a schematic structural diagram of another attack source tracing device provided by an embodiment of the present application;

Figure 11 is a schematic diagram of the hardware structure of a router provided by an embodiment of the present application;

Figure 12 is a schematic diagram of the hardware structure of a server provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application. The described embodiments are only part of the embodiments of the present application. Multiple operations described in the method implementations of the present application may be performed in different orders and/or performed in parallel. Furthermore, method embodiments may include additional operations and/or omit performance of illustrated operations. The scope of the present application is not limited in this respect.

The terms "first", "second", etc. in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, e.g., processes, methods, systems, products, or devices that encompass a series of operations or units and are not necessarily limited to those operations listed. or units, but may include other operations or units not listed or inherent to such processes, methods, products, or devices.

The names of messages or information exchanged between multiple devices in the embodiments of the present application are only for illustrative purposes and are not used to limit the scope of these messages or information.

Many of the attacked devices in the DDoS attack in this application are usually located within the jurisdiction of different controllers, and abnormal traffic usually affects multiple network domains. Figure 1 is a schematic diagram of an SDN architecture provided by an embodiment of this application. As shown in Figure 1, the attacker's attack traffic can reach the victim across multiple network domains. Each network domain includes an SDN controller and multiple edge switches. , the attack traffic is forwarded to a network domain, and the SDN controller in the network domain controls the attack traffic to be forwarded in multiple edge switches.

In order to hide their true information, attackers usually use forged source Internet Protocol (Internet Protocol) Protocol, IP) address to launch a DDoS attack on the attacker. There are two main types of defense against DDoS attacks on the network: One method is to respond immediately after detecting a DDoS attack. This method can quickly respond to DDoS attacks on the network, but it cannot parse the data in the data packet. The source IP address locates the attacker's true location and cannot block the DDoS attack from the source. Another way is to first trace the source of the attack after detecting a DDoS attack, and then conduct DDoS defense from the source of the attack based on the traceability results.

DDoS attack source tracing refers to the process in which the victim determines the source and propagation path of the attack data packet in a way, because the path forwarded by the data packet in the network will not be forged. When the DDoS detection method finds that a DDoS attack has occurred, the victim Using traceability methods to reconstruct the attack path or locate the source of the attack to block DDoS attacks at the source and restore the attack path is an important part of the DDoS attack defense system. Therefore, the real attack source can be traced by reconstructing the attack path. Subsequently, based on the traceability results, the victim can deploy a secure DDoS mitigation strategy to mitigate the impact of the DDoS attack, and can also impose sanctions on the attacker.

The global Internet is divided into multiple AS domains. Each AS domain will be assigned a globally unique Autonomous System Number (ASN), which is used to exchange external routing information between adjacent AS domains. ASNs are represented in two different formats: 2-byte and 4-byte. A 2-byte ASN is a 16-bit number, and this format provides 65,536 ASNs (0 to 65535); a 4-byte ASN is a 32-bit number, and this format provides 232 or 4,294,967,296 ASNs (0 to 4294967295 ). In 2012, the Internet Engineering Task Force (IETF) updated the standard Request For Comments (RFC) 6793. There is no longer a difference between 2-byte and 4-byte ASNs, and all ASNs should be considered 4 byte. ASN is defined in this application as an unsigned 32-bit integer.

An attack source tracing method provided by the embodiment of this application is a DDoS attack source tracing method across multiple network domains. Next, the embodiments of the present application will be described.

Figure 2 is a schematic flowchart of an attack source tracing method provided by an embodiment of the present application. This method can be applied to respond to large-scale DDoS attacks across multiple network domains. This method can be executed by an attack source tracing device, wherein the device can be It is implemented in software and/or hardware and is generally integrated on a router. In this embodiment, the router may be a router at the entrance of the AS domain.

As shown in Figure 2, an attack source tracing method provided by the embodiment of this application is executed by routers at multiple different AS domain entrances. Each router can execute:

S110. Obtain the data packet sent from the attack source device to the attacked device.

The attack source device and the attacked device can be IoT devices. The data packets can be traffic data packets sent by the attack source device to the attacked device. There is no limit on the number of data packets here.

In this embodiment, the data packet can pass through multiple AS domains in the process of being forwarded from the attack source device to the attacked device. After the data packet is forwarded to an AS domain, the router at the entrance in the AS domain can obtain the data packet. There is no limit on how to obtain data packets.

S120. Mark the data packet to obtain a marked data packet, so that the attacked device can trace the attack source device according to the target data packet.

Marked packets can be understood as traffic packets with marked information. The target data packet is the traffic data packet with complete marking information obtained after being marked for the last time by the last AS.

In this embodiment, when the data packet is forwarded from the attack source device to the attacked device, each time it passes through an AS domain, the data packet can be marked according to the autonomous system number of the current AS domain to obtain the marked data packet. The target data packet can be obtained after the last AS domain is marked for the last time.

In this embodiment, after the attacked device obtains the target data packet, the server corresponding to the attacked device can trace the attack source device according to the mark information in the target data packet.

Marking the data packet to obtain a marked data packet includes: inserting a partial number of the autonomous system number of the current autonomous system AS domain that the data packet passes through as marking information into the data packet to obtain a marked data packet.

Each AS domain has a corresponding globally unique number, that is, the autonomous system number ASN. The ASN can be inserted into the data packet as marking information. ASN can be represented as an unsigned 32-bit integer.

In this embodiment, the data packet includes a preset mark area, which can be understood as a preset free area. The mark area can include different fields, and different fields have different indications. The preset mark area can be obtained by rewriting the IP header of the data packet.

Inserting the partial number of the autonomous system number of the current autonomous system AS domain that the data packet passes through as marking information into the data packet includes: evenly dividing the autonomous system number of the current autonomous system AS domain into a preset number fragments, one fragment corresponding to a part of the autonomous system number; according to the instructions of the corresponding field in the preset marking area in the data packet, the target fragments among the preset number of fragments are used as markers The information is inserted into the fragment storage field of the packet.

In this embodiment, the number of fragments can be determined based on the hop count between the attack source device and the attacked device. Among them, the preset number can be greater than or equal to 2. The larger the preset number, the more slices an autonomous system number ASN is divided into, and the more slices need to be distributed and stored in more data packets. Each data packet Each time it passes through an AS domain, one shard is added and stored. Therefore, the smaller the number of shards into which an ASN is divided, the smaller the number of data packets required and the less overhead the system has. The number of fragments is the same as the number of data packets. That is, if the ASN is evenly divided into a preset number of fragments, a preset number of data packets need to be obtained correspondingly, and each data packet correspondingly stores one fragment. For example, if the ASN is evenly divided into three fragments, the three fragments need to be stored in three data packets respectively.

For example, the ASN can be evenly divided into two pieces. The first half piece corresponds to the first half number of the ASN, and the second half piece corresponds to the second half number of the ASN.

The preset mark area can be obtained by rewriting the service type field, reserved field and option field of the data packet IP header. Since the length of the option field of the data packet IP header is variable, the option field can be used as the preset mark area. Shard storage field, used to store shards. The preset tag area may include a packet tag field, a fragment tag field, a distance length field, a fragment insertion field, and a fragment storage field.

Figure 3 is a schematic diagram of a data packet IP header rewritten into a preset mark area provided by an embodiment of the present application. As shown in Figure 3, the shaded part in the figure represents the IP header field, that is, the rewritten part of the data packet IP header. , rewrite the shaded part as the mark field, which is the preset mark area. The mark field can be composed of the 1-bit packet mark field Flag_RF, the 1-bit fragment mark field AS_Num, the 4-bit distance length field Distance, the 1-bit fragment insertion field Frag, and Composed of variable-length shard storage field AS_Path.

The packet mark field indicates whether the data packet is marked; the fragment mark field indicates the target fragment among the preset number of fragments obtained by dividing the autonomous system number of the AS domain; the distance length field indicates the number of AS domains that the data packet passes through ; The fragment insertion field indicates the target fragment inserted into the data packet; the fragment storage field stores the target fragments of all AS domains.

In this embodiment, whether the obtained data packet is marked can be distinguished according to the data packet mark field. For example, the value of the data packet mark field is 0 or 1, 0 means not marked, and 1 means marked; according to the preset The fragmentation mark field of the number of data packets can determine which fragments the ASN is divided into. For example, the fragmentation mark field has values of 0 and 1, 0 indicates the first half fragmentation, and 1 indicates the second half fragmentation; according to the distance The length field can know how many AS domains the data packet passes through. The value of the distance length field can be 0-15. According to the distance length field in the target data packet, the distance between the attack source device and the attacked device can be known; according to fragmentation The insert field can determine which fragment is inserted into the data packet as the target fragment. For example, the value of the fragment insertion field is 0 or 1. 0 means that the first half of the fragment is inserted into the fragment storage field of the data packet. 1 means inserting the second half of the fragment into the fragment storage field of the packet.

The number of the data packets is the preset number. Correspondingly, according to the indication of the corresponding field in the preset mark area in the data packet, the target fragments among the preset number of fragments are used as markers. Information is inserted into the fragment storage field of the data packet, including: for each data packet, determining the target fragment according to the fragment tag field; using the target fragment as tag information; inserting according to the fragment The indication of the field inserts the mark information into the shard storage field. Wherein, the fragmentation mark fields of different data packets correspondingly indicate different fragments among the preset number of fragments.

In this embodiment, if the number of fragments is a preset number, then the preset number of fragments needs to be stored in a preset number of data packets, and each data packet passes through an AS domain and stores one more. Fragmentation. For each packet, you can insert words based on the fragment tag field and fragment in the packet. The segment determines the target fragment and inserts the target fragment into the packet.

For example, for data packets passing through the first AS domain, the ASN of the first AS domain is divided into two fragments and inserted into different data packets respectively. At the same time, the fragmentation mark field and fragmentation insertion field of the data packet containing the first half of the fragment as marking information are set to 0, and the fragmentation marking field and fragmentation insertion field of the data packet containing the second half of the fragmentation as marking information are set to 0. is 1; for data packets passing through other AS domains, if the value of the fragment tag field is 0, then the target fragment is determined to be the first half fragment, and the first half fragment is used as the marking information. At this time, the value of the fragment insertion field is If it is also 0, the tag information will be inserted into the fragment storage field of the data packet according to the fragment insertion field instructions. The values of the fragment insertion field and the fragment tag field are the same.

After a target fragment is added to the data packet, the value of the distance length field increases accordingly. In this embodiment, each time a data packet passes through an AS domain, a target fragment is added to the data packet. Each time a target fragment is added, the value of the distance length field in the preset mark area of the data packet is will be increased by 1. Here, when the data packet reaches the attacked device through multiple AS domains, the value of the distance length field in the preset mark area of the target data packet indicates the distance between the attacked device and the attack source device.

The data packets are acquired within a preset time period, and the data packets are marked.

In this embodiment, the attack source device can continuously send data packets, and can choose to obtain data packets once within a preset period and mark the data packets. It can effectively avoid the problem of being unable to trace the source after the marked data packet is lost. This application can also obtain the data packet again and mark the data packet after the data packet is lost. In addition, flexible marking of data packets in a preset time period can improve the accuracy of attack source tracing.

An attack source tracing method provided by the embodiment of this application has the following effects: first, the number of routers participating in AS traceability marking is much smaller than the number of routers in the network, which can effectively reduce the router overhead; second, the path length based on AS needs to be Far smaller than the IP-based path length in related technologies, the number of data packets required for path reconstruction is small, and the calculation overhead is small; thirdly, only a limited number of data packets are marked in this application, and any router cannot cover the upstream router. Mark information, so the marking information will not be lost; fourth, in this application, only the router at the entrance of each AS domain participates in marking, and the traceability is fast; fifth, the marking information in this application is ASN; sixth, based on AS Cross-domain attack source tracing does not require exposing the network topology, and there are no bandwidth requirements.

Based on the above embodiment, this application provides an embodiment. In this embodiment, the number of data packets obtained by the router is 2. Correspondingly, the ASN of each AS domain is evenly cut into 2 fragments. .

Figure 4 is a flow example diagram of another attack source tracing method provided by the embodiment of the present application. As shown in Figure 4, the attacker, that is, the attack source device, sends a data packet from the AS ₁ domain to the victim in the AS _n domain and is attacked. equipment. Among them, R ₁ can represent the ingress router of the AS ₁ domain, and R ₂ can represent the ingress route of the AS ₂ domain. Router, R ₃ can represent the egress router of the AS ₂ domain, R ₄ can represent the ingress router of the AS ₃ domain, R ₅ can represent the egress router of the AS ₃ domain, R ₆ can represent the ingress router of the AS ₄ domain, and R ₇ can Represents the egress router of the AS ₄ domain, and R _n can represent the ingress router of the AS _n domain.

In one embodiment, when the ingress router R ₁ connected to the attacker obtains 2 data packets, it can first insert marking information into the 2 data packets and then forward them to the AS ₂ domain. The process is as follows: Router R ₁ , which is the closest to the attacker, marks the two data packets sent by the attacker respectively, that is, inserting the ASN _1-1 fragment obtained by cutting ASN ₁ of the AS ₁ domain into data packet 1 as marking information. In the fragment storage field, insert the ASN _1-2 fragments obtained by cutting ASN ₁ of the AS ₁ domain into the fragment storage field of packet 2 as tag information; then add the packet tag fields in the two packets respectively. Set the value to 1, set the value of the fragmentation mark field in packet 1 to 0, and set the value of the fragmentation mark field in packet 2 to 1; forward the two packets to The next hop in the network. When R ₂ in the AS ₂ domain obtains the data packet, through the value of the fragment tag field in the data packet, the router selects which fragment obtained by cutting ASN ₂ as the tag information to insert into the data packet based on the value of the fragment insertion field. middle. The value of the fragment tag field in packet 1 is 0, indicating that the target fragment is the first half fragment. The value of the fragment insertion field is 0, indicating that the first half fragment in the ASN of the previous AS domain has been inserted into the data packet. If the fragment storage field of 1 is 1, the ASN _2-1 fragment obtained by cutting ASN ₂ will be inserted into the fragment storage field of packet 1 as tag information; the value of the fragment tag field in packet 2 is 1, indicating the target The fragment is the second half fragment, and the value of the fragment field is 1, indicating that the second half fragment in the ASN of the previous AS domain has been inserted into the fragment storage field of packet 2, then the ASN obtained by cutting ASN ₂ The _2-2 fragment is inserted into the fragment storage field of packet 2 as tag information. Since the R ₃ domain and the R ₂ domain belong to the same network domain, and ASN ₂ has been inserted, the insertion is skipped and the data packet is forwarded directly to the next hop router. Follow the above process until the data packet is forwarded to the AS _n domain where the victim is located, and the fragment storage field of the data packet forwarded to the AS _n domain includes the tag information of n AS domains. After the victim collects two complete ASNs, the attack path can be reconstructed based on the ASNs and the source of the attack can be traced.

Figure 5 is a schematic flowchart of another attack source tracing method provided by an embodiment of the present application. This method can be applied to respond to large-scale DDoS attacks across multiple network domains. This method can be executed by an attack source tracing device, where the device It can be implemented by software and/or hardware, and is generally integrated on a server. In this embodiment, the server can be the server of the attacked device.

As shown in Figure 5, an attack source tracing method provided by the embodiment of this application includes:

S210. When an attack is detected, extract the target data packet. The target data packet has complete tag information. The complete tag information includes the autonomous system numbers of all AS domains between the attack source device and the attacked device. .

In this embodiment, the method in which the attack is detected is not limited. For example, DDoS is detected according to the DDoS attack detection algorithm.

In this embodiment, when an attack is detected, multiple target data packets can be extracted to perform path reconstruction based on the tag information in the fragment storage field of the target data packet.

S220: Reconstruct the AS path between the attack source device and the attacked device according to the fragment storage field in the target data packet.

In this embodiment, all AS domains that the data packet passes through during forwarding can be determined based on the mark information in the fragmented storage fields of multiple target data packets. Therefore, the relationship between the attack source device and the attacked device can be reconstructed. AS path.

The number of target data packets is a preset number. Correspondingly, the AS path between the attack source device and the attacked device is reconstructed based on the fragment storage field in the target data packet, including: Extract the fragments in the fragment storage fields of the preset number of target data packets into the reconstruction path table; when the reconstruction path table includes complete mark information, obtain all the fragments in each target data packet. According to the value of the fragmentation mark field, each target data packet is extracted in sequence according to the sorting order corresponding to the preset number of values; for the fragmentation storage field of each target data packet extracted according to the sorting order, Fragments are extracted; according to the distance length field in each target data packet, the fragments in the fragment storage field of each target data packet are reconstructed to obtain the AS between the attack source device and the attacked device. path.

The complete mark information included in the reconstruction path table can be understood as the mark information in the reconstruction path table can be spliced into a complete AS path. At this time, the server no longer fills the fragments in the fragment storage field into the reconstruction path. in the path table.

The extraction order of target data packets can be determined based on the value of the fragmentation flag field in each target data packet. For example, if the value of the fragmentation mark field of the first target data packet is 0 and the value of the fragmentation mark field of the second target data packet is 1, then the target data can be sorted in order from 0 to 1. Packets are extracted, that is, the first target data packet is extracted first, and then the second target data packet is extracted.

Extracting the fragments in the fragment storage field of the preset number of target data packets into the reconstruction path table may include: according to the distance length field and the fragment mark field of the preset number of target data packets, extracting the preset number of target data packets into the reconstruction path table. Each fragment in the fragment storage field of the target packet is extracted into the reconstructed path table.

Extracting fragments from the fragment storage fields of the preset number of target data packets into the reconstruction path table includes: based on the distance length field and fragmentation mark field in the preset number of target data packets, Determine each fragment in the fragment storage field of the preset number of target data packets; extract each fragment in the determined fragment storage field of the preset number of target data packets to the reconstruction path table.

Each fragment in the fragment storage field is determined based on the distance length field and fragmentation mark field of the preset number of target data packets, that is, divided according to the distance length field and fragmentation mark field of the preset number of target data packets. Fragmentation.

The fragments of each target packet are stored in words according to the distance length field in each target packet. Reconstruct the fragments in the segment to obtain the AS path between the attack source device and the attacked device, including: the value according to the value of the distance length field in each target data packet and the preset number Sort the fragments in the fragment storage field of each target data packet in order from small to large to obtain a preset number of coding blocks. One data packet corresponds to one coding block. ; Splicing the preset number of coding blocks according to the sorting order to obtain a target coding block, where the target coding block includes complete mark information; determining the attack source device to the attacked device according to the complete mark information AS paths between devices.

Figure 6 is a schematic diagram of AS path reconstruction in an attack source tracing method provided by the embodiment of the present application. As shown in Figure 6, the attacker, that is, the attack source device, passes two data packets from the AS1 domain through the AS2 domain, AS3 domain, etc. After many AS domains are forwarded to the ASn domain, the server of the attacked device can extract the fragments in the fragment storage field of the target data packet P1, namely ASN _1-1 , ASN _2-1 , ASN _3-1 ...ASN _{n- 1.} Extract the fragments in the fragment storage field of the target data packet P2, namely ASN _1-2 , ASN _2-2 , ASN _3-2 ...ASN _n-2 ; compare the values of P1 and P2 according to the value of the distance length field. The fragments are sorted in order from 0 to n, and the fragments of P1 and P2 are spliced up and down according to the order of the fragment tag field from 0 to 1. For example, ASN _1-1 and ASN _1-2 are spliced up and down. After splicing, ASN ₁ is obtained. After splicing ASN ₁ , ASN ₂ , ASN ₃ ...ASN _n according to the above splicing method, the AS path is obtained.

S230. Trace the attack source device according to the AS path.

In this embodiment, all AS domains that the data packet passes through during forwarding can be known based on the AS path, and the attack source device can be traced back.

After finding the attack source device, you can effectively defend against the attack. For example, after finding the AS domain where the attack source device is located, the SDN controller in the attacker domain can query the flow table information based on the DDoS attack detection and traceability results, and issue a forwarding request to the edge switch to allow or prohibit communication with the victim host. strategy, and ultimately effectively mitigate DDoS attacks from the source of the attack.

Figure 7 is a schematic diagram of an attack mitigation process provided by an embodiment of the present application. As shown in Figure 7, the attack mitigation process may include:

S1. After the victim domain detects a DDoS attack, it starts the inter-domain attack source tracing method to obtain {ASN, IPsrc, IPdst, src.port, dst.port} and initiates a blocking request.

S2. The SDN controller in the attacker's domain queries the flow table entries.

S3. The SDN controller in the attacker's domain delivers the new flow table to the edge switch for DDoS attack mitigation.

The embodiment of this application provides an attack source tracing method. This method uses the globally unique number ASN corresponding to each AS domain to mark the data packets sent by the attacker. The IP data packet is used as the information carrier for path reconstruction. The IP data packet is Rewrite the packet header, using the service type field, reserved fields and options of the IP header Field to store tag information. Enable the variable part of the IP packet header, i.e. the options field, to store the ASN fragment containing all AS domains traversed from the attacker to the victim, when the packet traverses all AS domains from the attacker to the victim , by inserting the globally unique number ASN of each AS domain into equal ASN fragments of fixed length at the ingress router of each AS domain into the custom idle fields of the data packets passing through the ingress router of each AS. That is, in the preset marked area. From the attacker to the victim, each time it passes through an AS domain, the ingress router of the AS domain selects a fragment from the ASN of the AS according to the marking rules and inserts it into the corresponding data packet until all the packets from the attacker are traversed. to the AS domain between victims. Finally, when the AS domain where the victim is located collects data packets that include complete tag information, the complete attacker-to-victim data can be reconstructed based on the correspondence between the distance length field, the fragment tag field, and the fragment storage field. AS path between.

Figure 8 is an example flow chart of another attack source tracing method provided by the embodiment of the present application. As shown in Figure 8, the ASN is 2 bytes and 4 bytes. Figure 8 shows from the attacker AS234 domain to the victim AS6800 domain. A simple network topology diagram. In Figure 8, the router R1, which is directly connected to the attacker, inserts the two fragments of ASN234 into the AS_Path fields of the two data packets, and at the same time sets the Flag_RF field, the data packet mark field. is 1, indicating that the data packet is a marked data packet; according to the data information of the fragment storage field AS_Path, the fragmentation mark field AS_Num and the fragmentation insertion field Frag of the data packet storing fragmentation 0000000000000000 are set to 0, and the fragmentation is stored. The fragmentation mark field AS_Num and the fragmentation insertion field Frag of the data packet 0000000011101010 are set to 1, and the distance length field Distance is set to 0. When router R3 receives the data packet, it first checks whether the arriving data packet is marked according to the Flag_RF field. If the arriving data packet is marked, it checks the value of the AS_Num field of the data packet, and then fragments the ASN 68200 according to the value of the Frag field. Added to the marked packet. If the Frag field is 0, insert 000000000000001 in AS_Path; if the Frag field is 1, insert 0000101001101000 in AS_Path, and forward the data packet to the next hop router R4. R4 and R5 skip inserting. Since routers R4 and R5 are in the same domain as router R3, routers R4 and R5 skip inserting ASN information because the ASN of this domain has already been inserted at router R3. And forward the data packet to R6 normally. R6 repeats the above process and inserts the ASN 6800 fragments into the corresponding data packets. The marked path packet finally received at the victim end contains two fragmented packets with path information ASN 234, ASN 68200 and ASN 6800. When an attack is detected in the victim domain, attack source tracing begins. The victim server extracts the collected marked information packets and reconstructs the attack path. According to the corresponding relationship between the values of the Distance field and the AS_Num field and the ASN of the AS_Path field, the AS path between the attacker and the victim is finally restored.

An attack source tracing method provided by the embodiment of this application is an AS-oriented multi-domain DDoS attack source tracing method. This method has the advantages of fast source tracing speed and low system overhead. This application is to reduce the number of data packets required for path reconstruction, reduce the number of routers participating in marking, reduce the resource overhead of routers, improve the backtracking speed of cross-domain traceability, and improve the capabilities of cross-domain DDoS defense mechanisms.

Figure 9 is a schematic structural diagram of an attack source tracing device provided by an embodiment of the present application. The device can be adapted to It is used to deal with large-scale DDoS attacks across multiple network domains. The device can be implemented by software and/or hardware and is generally integrated on a router. The router in this embodiment can be a router at the entrance of the AS domain.

As shown in Figure 9, the device includes: an acquisition module 110 and a marking module 120.

The acquisition module 110 is configured to acquire data packets, which are sent from the attack source device to the attacked device; the marking module 120 is configured to mark the data packets to obtain marked data packets, so that the attacked device can The target data packet traces back to the attack source device, and the target data packet is a marked data packet obtained after final marking of the data packet.

This embodiment provides an attack source tracing device that can reduce the number of data packets required for path reconstruction, reduce the number of routers participating in marking, reduce router resource overhead, and improve the backtracking speed of cross-domain traceability.

The marking module 120 includes an insertion sub-module, and the insertion sub-module is configured to insert the partial number of the autonomous system number of the current autonomous system AS domain that the data packet passes through as marking information into the data packet to obtain a marked data packet.

The insertion sub-module is configured to: evenly divide the autonomous system number of the current autonomous AS domain into a preset number of fragments, one fragment corresponding to a part of the autonomous system number; according to the preset mark in the data packet According to the indication of the corresponding field in the area, the target fragment among the preset number of fragments is inserted into the fragment storage field of the data packet as mark information.

The preset mark area includes a data packet mark field, a fragment mark field, a distance length field, a fragment insertion field and a fragment storage field; the data packet mark field indicates whether the data packet is marked; the fragment mark field Indicates the target fragment among the preset number of fragments obtained by dividing the autonomous system number of the AS domain; the distance length field indicates the number of AS domains that the data packet passes through; the fragment insertion field indicates insertion into the data packet The target fragments; the fragment storage field stores the target fragments of all AS domains.

The number of the data packets is the preset number. Correspondingly, according to the indication of the corresponding field in the preset mark area in the data packet, the target fragments among the preset number of fragments are used as markers. Information is inserted into the fragment storage field of the data packet, including: for each data packet, according to the fragment tag field; determining the target fragment; using the target fragment as tag information; according to the fragment The instruction to insert a field inserts the mark information into the shard storage field. Wherein, the fragmentation mark fields of different data packets correspondingly indicate different fragments among the preset number of fragments.

After one of the target fragments is added to the data packet, the value of the distance length field increases accordingly. When the autonomous system number of an AS domain is evenly divided into two fragments, the number of data packets is 2.

The data packets are acquired within a preset time period, and the data packets are marked.

The attack source tracing device proposed in this embodiment has the same concept as the attack source tracing method proposed in the above embodiment. Technical details that are not described in detail in this embodiment can be found in any of the above embodiments, and this embodiment has the same features as the attack source tracing method. Effect.

Figure 10 is a schematic structural diagram of another attack source tracing device provided by an embodiment of the present application. This device can be suitable for responding to large-scale DDoS attacks across multiple network domains. The device can be implemented by software and/or hardware, and is generally Integrated on the server, the server in this embodiment may be a server in the AS domain where the attacked device is located.

As shown in Figure 10, the device includes: an extraction module 210, a reconstruction module 220 and a traceability module 230.

The extraction module 210 is configured to extract a target data packet when a distributed denial-of-service attack is detected. The target data packet has complete mark information, and the complete mark information includes the link between the attack source device and the attacked device. The autonomous system numbers of all AS domains; the reconstruction module 220 is configured to reconstruct the AS path between the attack source device and the attacked device according to the fragment storage field in the target data packet; the traceability module 230. Set to trace the attack source device according to the AS path.

This embodiment provides an attack source tracing device, which can reduce the storage of the router, improve the performance of the router, accurately reconstruct the AS path based on the mark information, and quickly trace the attack source device.

The number of target data packets is a preset number. Correspondingly, the reconstruction module 220 is set to:

Extract the fragments in the fragment storage fields of the preset number of target data packets into the reconstruction path table; when the reconstruction path table includes complete mark information, obtain all the fragments in each target data packet. According to the value of the fragmentation mark field, each target data packet is extracted in sequence according to the sorting order corresponding to the preset number of values; for the fragmentation storage field of each target data packet extracted according to the sorting order, Fragments are extracted; according to the distance length field in each target data packet, the fragments in the fragment storage field of each target data packet are reconstructed to obtain the AS between the attack source device and the attacked device. path.

The reconstruction module 220 includes an extraction sub-module, and the extraction sub-module is configured to: determine the fragmented storage of the preset number of target data packets based on the distance length field and fragmentation mark field in the preset number of target data packets. Each fragment in the field; extract each fragment in the fragment storage field of the determined preset number of target data packets into the reconstruction path table.

The reconstruction module 220 includes a reconstruction sub-module, and the reconstruction sub-module is configured as:

The fragments of each target data packet are stored in ascending order according to the value of the distance length field in each target data packet and the value of the fragmentation mark field in the preset number of target data packets. The fragments in the field are sorted to obtain a preset number of coding blocks, and one data packet corresponds to one coding block; the preset number of coding blocks are spliced according to the sorting order to obtain the target coding block. code block, the target coding block includes complete mark information; the AS path between the attack source device and the attacked device is determined based on the complete mark information.

The attack source tracing device proposed in this embodiment has the same concept as the attack source tracing method proposed in the above embodiment. Technical details that are not described in detail in this embodiment can be found in any of the above embodiments, and this embodiment has the same features as the attack source tracing method. Effect.

An embodiment of the present application also provides a router. FIG. 11 is a schematic diagram of the hardware structure of a router provided by an embodiment of the present application. As shown in Figure 11, the router provided by the embodiment of the present application includes a memory 520, a processor 510, and a computer program stored in the memory and executable on the processor. When the processor 510 executes the program, the above-mentioned attack source tracing is implemented. method.

The router may also include a memory 520; there may be one or more processors 510 in the router, and one processor 510 is taken as an example in Figure 11; the memory 520 is configured to store one or more programs; the one or more programs is executed by the one or more processors 510, so that the one or more processors 510 implement the attack source tracing method as described in the embodiment of this application.

The router also includes: communication device 530, input device 540 and output device 550.

The processor 510, memory 520, communication device 530, input device 540 and output device 550 in the router can be connected through a bus or other means. In Figure 11, connection through a bus is taken as an example.

The input device 540 may be configured to receive input numeric or character information and generate key signal input related to user settings and function control of the terminal device. The output device 550 may include a display device such as a display screen.

Communication device 530 may include a receiver and a transmitter. The communication device 530 is configured to perform information transceiver communication according to the control of the processor 510 .

As a computer-readable storage medium, the memory 520 can be configured to store software programs, computer executable programs and modules, such as program instructions/modules corresponding to the attack source tracing method described in the embodiments of the present application (for example, the acquisition of the attack source traceability device) module 110 and marking module 120). The memory 520 may include a storage program area and a storage data area, where the storage program area may store an operating system and at least one application program required for a function; the storage data area may store data created according to the use of the router, and the like. In addition, memory 520 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device. In some examples, memory 520 may include memory located remotely from processor 510, and these remote memories may be connected to a router through a network. Examples of the above-mentioned networks include the Internet, intranets, local area networks, mobile communication networks and combinations thereof.

The embodiment of the present application also provides a server. Figure 12 is a schematic diagram of the hardware structure of a server provided by the embodiment of the present application. As shown in Figure 12, the server provided by the present application includes a memory 620, The processor 610 and a computer program stored in the memory and executable on the processor implement the above attack source tracing method when the processor 610 executes the program.

The server may also include a memory 620; there may be one or more processors 610 in the server, and one processor 610 is taken as an example in Figure 12; the memory 620 is configured to store one or more programs; the one or more programs is executed by the one or more processors 610, so that the one or more processors 610 implement the attack source tracing method as described in the embodiment of this application.

The server also includes: communication device 630, input device 640 and output device 650.

The processor 610, memory 620, communication device 630, input device 640 and output device 650 in the server can be connected through a bus or other means. In Figure 12, connection through a bus is taken as an example.

The input device 640 may be configured to receive input numeric or character information and generate key signal input related to user settings and function control of the terminal device. The output device 650 may include a display device such as a display screen.

Communication device 630 may include a receiver and a transmitter. The communication device 630 is configured to perform information transceiver communication according to the control of the processor 610 .

As a computer-readable storage medium, the memory 620 can be configured to store software programs, computer executable programs and modules, such as program instructions/modules corresponding to the attack source tracing method described in the embodiments of the present application (for example, the extraction method in the attack source tracing device). module 210, reconstruction module 220 and traceability module 230). The memory 620 may include a program storage area and a data storage area, where the program storage area may store an operating system and an application program required for at least one function; the storage data area may store data created according to use of the server, and the like. In addition, the memory 620 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device. In some examples, memory 620 may include memory located remotely from processor 610, and these remote memories may be connected to the server through a network. Examples of the above-mentioned networks include the Internet, intranets, local area networks, mobile communication networks and combinations thereof.

Embodiments of the present application also provide a storage medium. The storage medium stores a computer program. When the computer program is executed by a processor, any of the attack source tracing methods described in the embodiments of the present application is implemented.

The attack source tracing method, applied to routers, includes: obtaining data packets, which are sent from the attack source device to the attacked device; marking the data packets to obtain marked data packets, so that the attacked device can The data packet traces back to the attack source device, and the target data packet is a marked data packet obtained after final marking of the data packet.

The attack source tracing method, applied to the server, includes: when an attack is detected, extracting a target data packet, the target data packet has complete mark information, and the complete mark information includes the link between the attack source device and the attacked device. Autonomous system numbers for all AS domains; based on the points in the target packet The slice storage field reconstructs the AS path between the attack source device and the attacked device; the attack source device is traced according to the AS path.

The computer storage medium in the embodiment of the present application may be any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. Examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard drive, random access memory (RAM), read only memory (Read Only) Memory (ROM), Erasable Programmable Read Only Memory (EPROM), flash memory, optical fiber, portable compact disk read-only memory (Compact Disk-Read Only Memory, CD-ROM), optical storage devices, magnetic memory device, or any suitable combination of the above. A computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device.

A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave carrying computer-readable program code therein. This propagated data signal can take many forms, including: electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device .

Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including: wireless, wire, optical cable, radio frequency (Radio Frequency, RF), etc., or any suitable combination of the above.

Computer program code for performing operations of the present application may be written in one or more programming languages, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional A procedural programming language, such as the "C" language or similar programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In situations involving remote computers, the remote computer can be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or it can be connected to an external computer (e.g. Use an Internet service provider to connect via the Internet).

The above descriptions are only exemplary embodiments of the present application and are not used to limit the protection scope of the present application.

Those skilled in the art will understand that the term user terminal covers any suitable type of wireless user Devices such as mobile phones, portable data processing devices, portable web browsers or vehicle-mounted mobile stations.

Generally speaking, the various embodiments of the present application may be implemented in hardware or special purpose circuitry, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device, although the application is not limited thereto.

Embodiments of the present application may be implemented by a data processor of the mobile device executing computer program instructions, for example in a processor entity, or by hardware, or by a combination of software and hardware. Computer program instructions may be assembly instructions, Instruction Set Architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or written in any combination of one or more programming languages source code or object code.

Any block diagram of a logic flow in the figures of this application may represent program operations, or may represent interconnected logic circuits, modules, and functions, or may represent a combination of program operations and logic circuits, modules, and functions. Computer programs can be stored on memory. The memory may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as ROM, RAM, optical storage devices and systems (Digital Video Disc (DVD) or CD, etc.) The computer may The read media may include non-transitory storage media. The data processor may be any type suitable for the local technical environment, such as a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (Digital Signal Processing, DSP), or an application-specific integrated circuit. (Application Specific Integrated Circuit, ASIC), programmable logic device (Field-Programmable Gate Array, FPGA) and processors based on multi-core processor architecture.

Claims (17)

An attack source tracing method, executed by the router, including: Obtaining a data packet, wherein the data packet is sent from the attack source device to the attacked device; The data packet is marked to obtain a marked data packet, so that the attacked device can trace the attack source device according to the target data packet, and the target data packet is a marked data packet obtained after final marking of the data packet. The method according to claim 1, wherein marking the data packet to obtain a marked data packet includes: The partial number of the autonomous system number of the current autonomous system AS domain that the data packet passes through is inserted into the data packet as marking information to obtain the marked data packet. The method according to claim 2, wherein inserting the partial number of the autonomous system number of the current autonomous system AS domain that the data packet passes through as marking information into the data packet includes: Evenly divide the autonomous system number of the current autonomous AS domain into a preset number of fragments, where one fragment corresponds to a part of the autonomous system number; According to the indication of the corresponding field in the preset mark area in the data packet, the target fragments among the preset number of fragments are inserted into the fragment storage field of the data packet as mark information. The method according to claim 3, wherein the preset mark area includes a packet mark field, a fragment mark field, a distance length field, a fragment insertion field and a fragment storage field; The data packet marking field indicates whether the data packet is marked; The fragment tag field indicates the target fragment among the preset number of fragments obtained by dividing the autonomous system number of the AS domain; The distance length field indicates the number of AS domains that the data packet passes through; The fragment insertion field indicates the target fragment inserted into the data packet; The fragment storage field stores target fragments of all AS domains. The method according to claim 4, wherein the number of the data packets is the preset number, and the preset number is changed according to the indication of the corresponding field in the preset mark area in the data packet. The target fragment among the fragments is inserted into the fragment storage field of the data packet as marking information, including: For each data packet, determine the target fragment according to the fragment tag field; Use the target fragments as mark information; The mark information is inserted into the fragment storage field according to the instruction of the fragment insertion field. Wherein, the fragment tag fields of different data packets correspondingly indicate different fragments among the preset number of fragments. Fragmentation. The method according to claim 4, wherein after a target fragment is added to the data packet, the value of the distance length field increases accordingly. The method according to claim 3, wherein when the autonomous system number of an AS domain is evenly divided into two fragments, the number of the data packets is 2. The method of claim 1, further comprising: The data packet is acquired within a preset time period and marked. An attack source tracing method, executed by the server, including: When an attack is detected, the target data packet is extracted, wherein the target data packet has complete tag information, and the complete tag information includes the autonomous system numbers of all autonomous system AS domains between the attack source device and the attacked device. ; Reconstruct the AS path between the attack source device and the attacked device according to the fragment storage field in the target data packet; Trace the attack source device according to the AS path. The method according to claim 9, wherein the number of target data packets is a preset number, and the distance between the attack source device and the attacked device is reconstructed according to the fragment storage field in the target data packet. AS path, including: Extract the fragments in the fragment storage fields of the preset number of target data packets into the reconstruction path table; When the reconstructed path table includes complete mark information, obtain the value of the fragment mark field in each target data packet, and extract each fragment in sequence according to the sorting order corresponding to the preset number of values. target packet; Extract the fragments in the fragment storage field of each target data packet extracted according to the sorting order; According to the distance length field in each target data packet, the fragments in the fragment storage field of each target data packet are reconstructed to obtain the AS path between the attack source device and the attacked device. The method according to claim 10, wherein extracting the fragments in the fragment storage fields of the preset number of target data packets into the reconstruction path table includes: Determine each fragment in the fragment storage field of the preset number of target data packets according to the distance length field and fragmentation mark field in the preset number of target data packets; Extract each fragment in the fragment storage field of the determined preset number of target data packets into in the reconstruction path table. The method according to claim 10, wherein the fragments in the fragment storage field of each target data packet are reconstructed according to the distance length field in each target data packet to obtain the attack source device. The AS path to the attacked device includes: According to the value of the distance length field in each target data packet and the value of the fragmentation mark field in the preset number of target data packets, the fragments in the fragmentation storage field of each target data packet are divided in order from small to large. The slices are sorted to obtain a preset number of coding blocks, in which one data packet corresponds to one coding block; Splice the preset number of coding blocks according to the sorting order to obtain a target coding block, where the target coding block includes complete mark information; The AS path between the attack source device and the attacked device is determined based on the complete mark information. An attack source tracing device, applied to routers, including: The acquisition module is configured to acquire data packets, wherein the data packets are sent from the attack source device to the attacked device; A marking module, configured to mark the data packet to obtain a marked data packet, so that the attacked device can trace the attack source device according to the target data packet, and the target data packet is finally marked after the data packet is Get the marked packet. An attack source tracing device, applied to servers, including: The extraction module is configured to extract the target data packet when a distributed denial of service attack is detected, wherein the target data packet has complete mark information, and the complete mark information includes the link between the attack source device and the attacked device. Autonomous system numbers of all autonomous system AS domains; A reconstruction module configured to reconstruct the AS path between the attack source device and the attacked device based on the fragmented storage field in the target data packet; A tracing module is configured to trace the attack source device according to the AS path. A router, including: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, any one of claims 1-8 is implemented. The described attack source tracing method. A server, including: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, any one of claims 9-12 is implemented. The described attack source tracing method. A storage medium that stores a computer program. When the program is executed by a processor, the attack source tracing method according to any one of claims 1-12 is implemented.