隐蔽信道能够以危害系统安全策略的方式传输信息,目前,基于网络协议的隐蔽信道研究已成为热点。域名系统协议(Domain Name System,DNS)用于将主机名字和IP地址之间的转换,是双向协议,互联网正常运行离不开DNS协议,因此可以基于DNS协议...隐蔽信道能够以危害系统安全策略的方式传输信息,目前,基于网络协议的隐蔽信道研究已成为热点。域名系统协议(Domain Name System,DNS)用于将主机名字和IP地址之间的转换,是双向协议,互联网正常运行离不开DNS协议,因此可以基于DNS协议建立隐蔽信道。文中首先介绍隐蔽信道、DNS隐蔽信道的概念和原理,搭建DNS隐蔽信道系统,然后演示了DNS隧道工具的使用方法,最后针对现有的DNS隐蔽信道工具提出了几点改进措施,使DNS隐蔽信道数据传输更加高效。展开更多
The Internet Control Message Protocol(ICMP)covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission.Its concealment is stronger and it is not eas...The Internet Control Message Protocol(ICMP)covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission.Its concealment is stronger and it is not easy to be discovered.Most detection methods are detecting the existence of channels instead of clarifying specific attack intentions.In this paper,we propose an ICMP covert tunnel attack intent detection framework ICMPTend,which includes five steps:data collection,feature dictionary construction,data preprocessing,model construction,and attack intent prediction.ICMPTend can detect a variety of attack intentions,such as shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attacks.We extract features from five types of attack intent found in ICMP channels.We build a multi-dimensional dictionary of malicious features,including shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attack keywords.For the high-dimensional and independent characteristics of ICMP traffic,we use a support vector machine(SVM)as a multi-class classifier.The experimental results show that the average accuracy of ICMPTend is 92%,training ICMPTend only takes 55 s,and the prediction time is only 2 s,which can effectively identify the attack intention of ICMP.展开更多
DNS作为互联网基础设施,很少受到防火墙的深度监控,导致黑客和APT组织通过DNS隐蔽隧道来窃取数据或控制网络,对网络安全造成严重威胁.针对现有检测方案容易被攻击者绕过以及泛化能力较弱的问题,本研究改进了DNS流量的表征方法,并提出了P...DNS作为互联网基础设施,很少受到防火墙的深度监控,导致黑客和APT组织通过DNS隐蔽隧道来窃取数据或控制网络,对网络安全造成严重威胁.针对现有检测方案容易被攻击者绕过以及泛化能力较弱的问题,本研究改进了DNS流量的表征方法,并提出了PFEC-Transformer(pcap features extraction CNN-Transformer)模型.该模型以表征后的十进制数值序列作为输入,在经过CNN模块进行局部特征提取后,再通过Transformer分析局部特征间的长距离依赖模式并进行分类.研究采集了互联网流量以及各类DNS隐蔽隧道工具生成的数据包构建数据集,并使用包含未知隧道工具流量的公开数据集进行泛化能力测试.实验结果表明,该模型在测试数据集上取得了高达99.97%的准确率,在泛化测试集上也达到了92.12%的准确率,有效地证明了其在检测未知DNS隐蔽隧道方面的优异性能.展开更多
文摘隐蔽信道能够以危害系统安全策略的方式传输信息,目前,基于网络协议的隐蔽信道研究已成为热点。域名系统协议(Domain Name System,DNS)用于将主机名字和IP地址之间的转换,是双向协议,互联网正常运行离不开DNS协议,因此可以基于DNS协议建立隐蔽信道。文中首先介绍隐蔽信道、DNS隐蔽信道的概念和原理,搭建DNS隐蔽信道系统,然后演示了DNS隧道工具的使用方法,最后针对现有的DNS隐蔽信道工具提出了几点改进措施,使DNS隐蔽信道数据传输更加高效。
基金This research was supported by National Natural Science Foundation of China(Grant Nos.61972048,62072051).
文摘The Internet Control Message Protocol(ICMP)covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission.Its concealment is stronger and it is not easy to be discovered.Most detection methods are detecting the existence of channels instead of clarifying specific attack intentions.In this paper,we propose an ICMP covert tunnel attack intent detection framework ICMPTend,which includes five steps:data collection,feature dictionary construction,data preprocessing,model construction,and attack intent prediction.ICMPTend can detect a variety of attack intentions,such as shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attacks.We extract features from five types of attack intent found in ICMP channels.We build a multi-dimensional dictionary of malicious features,including shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attack keywords.For the high-dimensional and independent characteristics of ICMP traffic,we use a support vector machine(SVM)as a multi-class classifier.The experimental results show that the average accuracy of ICMPTend is 92%,training ICMPTend only takes 55 s,and the prediction time is only 2 s,which can effectively identify the attack intention of ICMP.
文摘DNS作为互联网基础设施,很少受到防火墙的深度监控,导致黑客和APT组织通过DNS隐蔽隧道来窃取数据或控制网络,对网络安全造成严重威胁.针对现有检测方案容易被攻击者绕过以及泛化能力较弱的问题,本研究改进了DNS流量的表征方法,并提出了PFEC-Transformer(pcap features extraction CNN-Transformer)模型.该模型以表征后的十进制数值序列作为输入,在经过CNN模块进行局部特征提取后,再通过Transformer分析局部特征间的长距离依赖模式并进行分类.研究采集了互联网流量以及各类DNS隐蔽隧道工具生成的数据包构建数据集,并使用包含未知隧道工具流量的公开数据集进行泛化能力测试.实验结果表明,该模型在测试数据集上取得了高达99.97%的准确率,在泛化测试集上也达到了92.12%的准确率,有效地证明了其在检测未知DNS隐蔽隧道方面的优异性能.
