WO2018035962A1 - 一种用于处理伪造的tcp数据包的方法和系统 - Google Patents

一种用于处理伪造的tcp数据包的方法和系统 Download PDF

Info

Publication number
WO2018035962A1
WO2018035962A1 PCT/CN2016/104103 CN2016104103W WO2018035962A1 WO 2018035962 A1 WO2018035962 A1 WO 2018035962A1 CN 2016104103 W CN2016104103 W CN 2016104103W WO 2018035962 A1 WO2018035962 A1 WO 2018035962A1
Authority
WO
WIPO (PCT)
Prior art keywords
tcp
processed
packet
window
tcp packet
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/104103
Other languages
English (en)
French (fr)
Inventor
陈鸿
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Wangsu Science and Technology Co Ltd
Original Assignee
Wangsu Science and Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Wangsu Science and Technology Co Ltd filed Critical Wangsu Science and Technology Co Ltd
Priority to EP16913982.1A priority Critical patent/EP3432533B1/en
Priority to US16/068,797 priority patent/US10834126B2/en
Publication of WO2018035962A1 publication Critical patent/WO2018035962A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/19—Flow control; Congestion control at layers above the network layer
    • H04L47/193—Flow control; Congestion control at layers above the network layer at the transport layer, e.g. TCP related
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/27—Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/34—Flow control; Congestion control ensuring sequence integrity, e.g. using sequence numbers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures

Definitions

  • the present invention relates to the field of network security technologies, and in particular, to a method and system for processing forged TCP data packets.
  • TCP Transmission Control Protocol
  • TCP is a connection-oriented, reliable, byte stream-based transport layer communication protocol.
  • TCP is the most basic protocol of the Internet and the foundation of the Internet international Internet.
  • one common attack method is to forge TCP packets.
  • the client client establishes a connection with the server server after the TCP three-way handshake; subsequently, the client client sends a request packet to the server server; the hijacking device injector listens to the request packet through the listening device tap, and sends the forged package to the client client.
  • the response packet is forged packet; if no processing is performed, the forged packet of the forged packet will arrive at the client client before the real response packet from the server server, thereby replacing the server server with the client client. In this way, the client client is hijacked so that the client client thinks it is communicating with the server server, but actually communicates with the hijack device injector.
  • the present invention provides an improved method of processing forged TCP packets, including:
  • TCP packet header to be processed includes a window size field
  • the receiving window value of the TCP packet to be processed is calculated from a window size field of the TCP packet header to be processed and a receiving window expansion factor field in the record;
  • a system for processing a forged TCP packet comprising:
  • the TCP receiving window comparison table has a record related to the TCP packet to be processed, a window size field from the TCP packet header to be processed and a receiving window expansion factor field in the record Means for calculating a receiving window value of the TCP packet to be processed;
  • the key of the present invention is to calculate the receiving window of the TCP packet by using the window size field of the TCP packet header to be processed and the window scale factor (Window Scale), and compare it with the actual receiving window, if the TCP packet to be processed If the receiving window has a large deviation from the actual receiving window, it is determined that the TCP packet to be processed is a forged TCP packet and is processed accordingly.
  • Window Scale window scale factor
  • FIG. 1 is a schematic diagram of a packet header structure of a TCP packet.
  • Figure 2 is a schematic diagram of a TCP three-way handshake to establish a connection.
  • FIG. 3 is a schematic structural diagram of a window expansion factor option carried by a SYN packet sent during a TCP three-way handshake phase.
  • FIG. 4 is a schematic diagram of a data structure of a record in a TCP receiving window comparison table according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for establishing and/or updating a TCP receiving window comparison table according to an embodiment of the present invention.
  • FIG. 6 is a flow chart of a method for processing a forged TCP packet, in accordance with an embodiment of the present invention.
  • the present invention provides an improved method and system for processing forged TCP packets.
  • the key of the present invention is to calculate the receiving window of the TCP packet to be processed by using the window size field of the TCP packet header to be processed and the window scale factor, and compare it with the actual receiving window. Then, according to the degree of deviation of the comparison result from the threshold, it is determined whether the TCP packet to be processed is forged, thereby discovering and discarding the forged TCP packet with greater probability. More specifically, in the embodiment of the present invention, by establishing at least a TCP connection quad (source IP, source port, target IP, target port), actual TCP receiving window RCV.WND, and TCP receiving window expansion factor Rcv.
  • a TCP receive window comparison table of Wind.Scale uses the TCP receive window comparison table to discover (and discard) forged TCP packets with greater probability by ensuring the accuracy of the RCV.WND value corresponding to the TCP connection. The device is attacked as little as possible by forged TCP packets.
  • FIG. 1 a schematic diagram of a packet header structure of a TCP packet is shown.
  • the 16-bit source port number identifies the application that initiated the transfer on the host; the 16-bit destination port number identifies the application to be reached on the host.
  • the port number of the source and destination used to find the originating and receiving application processes. These two values plus the source IP address and the destination IP address in the IP header uniquely identify a T C P connection.
  • the TCP protocol uses "ports" to identify application processes at the source and destination.
  • the port number can use any number between 0 and 65535.
  • the 32-bit sequence number field is used to identify the data byte stream sent from the TCP source to the TCP target, which represents the sequence number of the first data byte in this segment.
  • the acknowledgment number field is valid only when the ACK flag is 1. It contains the sequence number of the next data byte that the destination expects to receive from the source.
  • 4-bit header length field gives the number of 32 bits (4 bytes) in the header.
  • the TCP header without any option field is 20 bytes long; it can have up to 60 bytes of TCP header.
  • 6-bit reserved field consists of 6 bits following the data offset field. The reserved bit is usually 0.
  • Flag bit field (URG, ACK, PSH, RST, SYN, FIN): 6 bits. The meaning of everyone is as follows:
  • PSH The receiver should hand this segment to the application layer as soon as possible.
  • RST Reset the connection.
  • 16-bit receive window size field This field is used for flow control.
  • the unit is byte. This value is the number of bytes that the unit expects to receive at one time.
  • 16-bit checksum field Checksum calculation of the entire TCP segment, that is, the TCP header and TCP data, and verified by the target.
  • 16-bit emergency pointer field It is an offset, and the value in the sequence number field is added to indicate the sequence number of the last byte of the urgent data.
  • Option field Up to 40 bytes. It may include options such as "window expansion factor” and "timestamp”.
  • the receiving window size field is marked as SEG.WND, which indicates the receiving window of the transmitting end.
  • TCP completes the initialization of the receiving window of both parties through the three-way handshake.
  • the client client and the server server can start transmitting data.
  • the structure of the window expansion factor option carried in the SYN data packet (the SYN flag bit of the header of the TCP packet is set) sent in the TCP three-way handshake phase is shown.
  • the first field of the option, Kind indicates the type of option.
  • the receive window size is represented by 16 bits, so the maximum is 65535 bytes, but in fact the TCP allows the receive window size to be much more than this number (in order to improve the throughput of TCP communication).
  • the window expansion factor solves this problem.
  • the receive window size in the TCP header is N and the window expansion factor (shift number) is M
  • the actual receive window size of the TCP segment is N by 2 M , or N is shifted left by M bits. Note that the value range of M is 0 to 14.
  • the second field Length in the option structure specifies the total length of the option structure, which includes the 2 bytes occupied by the Kind field and the Length field.
  • the receive window expansion factor is optional and its value is determined by the SYN packet during the TCP three-way handshake phase. The window expansion factor option carried by the TCP packet with the SYN flag set in the header is ignored.
  • the receiving window RCV.WND is equal to the window size field SEG.WND
  • the receiving window RCV.WND of other TCP packets is calculated as the window size field SEG.WND Move the Rcv.Wind.Scale bit to the left, ie
  • the receive window size in the TCP header is N and the window enlargement factor (shift number) is M
  • the actual receive window size of the TCP segment is N by 2 M , or N. Move M position to the left.
  • the change of the receiving window RCV.WND of the TCP connection is smooth, and no jump occurs (so-called "jump" means 1.5 times or more of the previous value).
  • the actual RCV.WND here is the RCV.WND of the packet corresponding to the TCP second handshake ⁇ SYN, ACK>.
  • the TCP receiving window comparison table is generally set on the gateway device. It should be understood that the gateway device herein may also be a security device such as a security detecting device or a firewall. In an implementation, the TCP receiving window comparison table may be established according to the RCV.WND obtained by the TCP second handshake ⁇ SYN, ACK>.
  • the TCP receiving window comparison table includes main information such as a TCP connection quaternary (source IP, source port, target IP, target port), actual TCP receiving window RCV.WND, and TCP receiving window expansion factor Rcv.Wind.Scale. It should be noted that the information stored in the receiving window comparison table is information related to the real host.
  • FIG. 4 a data structure diagram of a record in a TCP receiving window comparison table according to an embodiment of the present invention is specifically illustrated. As shown in FIG. 4, the comparison table includes the following fields:
  • the "key value” field indicates the hash value calculated from the quad of the TCP connection to facilitate quick lookup
  • the Connection Quad field including source IP, source port, destination IP, and destination port;
  • the "actual receiving window” field indicates the actual receiving window RCV.WND of the TCP connection, and the value can be obtained from the window size field SEG.WND of the packet corresponding to the TCP second handshake ⁇ SYN, ACK>.
  • the "receive window expansion factor” field indicates the receiving window expansion factor Rcv.Wind.Scale of the TCP connection, which can be shifted from the window expansion factor option carried by the corresponding packet of the TCP second handshake ⁇ SYN, ACK>.
  • the cnt field is obtained.
  • the Create Time field (optional) indicates when the entry was created.
  • FIG. 5 a flow diagram of creating and/or updating records in a TCP receive window lookup table in accordance with an embodiment of the present invention is described. It should be understood that the method can be used on network devices such as gateway devices, firewalls, routers, etc.; and, it should also be understood that updating the TCP receive window lookup table includes operations of adding, deleting, modifying records in the lookup table, and the like. The method comprises the following steps:
  • Step 502 Extract the real TCP connection quaternary, the receiving window RCV.WND (obtained by the window size field SEG.WND), and the receiving window from the data packet corresponding to the received TCP second handshake ⁇ SYN, ACK>.
  • the factor Rcv.Wind.Scale obtained by the shift.cnt field in the window expansion factor option, if there is no window expansion factor option, the default value is 0;
  • Step 504 Search a TCP receiving window comparison table according to the extracted connection quad to determine whether a related record already exists in the TCP receiving window comparison table.
  • Step 506 if no record having the connection quad is found in the TCP receiving window comparison table, establishing a TCP connection quad, a receiving window, and a receiving window expansion factor according to the obtained TCP connection window comparison table. a related record;
  • Step 508 if a record having the connection quad is already present in the TCP receiving window comparison table, updating the content of the corresponding field in the record using the obtained receiving window and the receiving window expansion factor, and optionally simultaneously Update the creation time field.
  • the stale record in the TCP receiving window comparison table that is created for a longer time from the current time may be deleted periodically.
  • the key values computed from the TCP connection quad may be used to look up the TCP receive window lookup table.
  • the gateway device receives the TCP.
  • the TCP receiving window comparison table can be searched according to the connection quad of the TCP packet. If there is a record with the same connection quad, the receiving window of the TCP packet is received. The RCV.WND is compared with the received window of the associated record to obtain a deviation between them, and if the deviation exceeds a predetermined threshold, the TCP packet can be suspected to be a forged TCP packet. This process will be described in detail below in conjunction with FIG.
  • a flowchart of a method for processing a forged TCP packet includes the following steps:
  • Step 602 receiving a TCP packet to be processed (excluding a SYN packet), the TCP packet header to be processed includes a window size field SEG.WND;
  • Step 604 According to the TCP packet to be processed, for example, the connection quaternary in the TCP packet to be processed, in a TCP receiving window comparison table, it is searched whether there is a TCP packet related to the to-be-processed TCP packet. Records, such as related records with the same connected quad;
  • Step 606 in step 604, if there is no related record having the same connection quad in the TCP reception window comparison table, the process ends.
  • Step 608 if the TCP receiving window comparison table has a related record having the same connection quad, the window size field SEG.WND from the TCP packet header to be processed and the receiving window expansion factor field Rcv.Wind in the related record.
  • the receiving window RCV.WND of the TCP packet to be processed is calculated in .Scale.
  • the receiving window RCV.WND of the TCP packet to be processed is a window size field SEG.WND of the TCP packet header to be processed according to Formula 1 and a receiving window expansion factor field Rcv.Wind.Scale in the related record. Calculate.
  • Step 610 Compare the calculated receiving window RCV.WND of the TCP packet to be processed with the actual receiving window RCV.WND in the related record to obtain a deviation between them. Specifically, the deviation is obtained by dividing the received receiving window RCV.WND of the to-be-processed TCP packet by the actual receiving window RCV.WND in the related record;
  • Step 612 comparing the deviation with a predetermined threshold, and:
  • the method proceeds to step 614 to perform corresponding processing on the TCP packet to be processed, for example, directly Discarding the TCP packet to be processed, or providing the user with a related prompt for the user to further distinguish the authenticity of the TCP packet to be processed, and the like;
  • the deviation does not exceed the predetermined threshold, it indicates that the TCP packet to be processed should be a real TCP packet, and therefore, proceeds to step 616 to allow the TCP packet to be processed to pass directly through the gateway device.
  • the "predetermined threshold” refers to the RCV.WND value of the TCP packet is related. According to the experiment, the value of the "predetermined threshold” may be ⁇ 1.5, that is, when the deviation exceeds 1.5 times, the TCP packet may be initially determined to be forged. TCP packets. In a preferred embodiment, the "predetermined threshold” is preferably 4 times, that is, when the deviation exceeds 4 times, the TCP packet is determined to be a forged TCP packet, and the "predetermined threshold” may be The judgment of the TCP forged package is made more accurate. However, the multiples are for illustrative purposes only and are not limiting. The user can adjust the "predetermined threshold" criteria according to actual conditions to adapt to different context requirements.
  • a more probable discovery is achieved by determining whether the receiving window of the TCP packet to be processed has a large deviation from the actual receiving window of the related record in the TCP receiving window comparison table ( Discarding forged TCP packets ensures that the device is attacked as little as possible by forged TCP packets.
  • the solution of the present invention is applicable not only to firewalls, DDoS type gateway systems and bypass similar IDS detection systems, but also to routers.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明涉及一种用于处理伪造的TCP数据包的方法和系统。具体而言，本发明利用待处理的TCP数据包头部的窗口大小字段与窗口扩大因子(Window Scale)计算出待处理的TCP数据包的接收窗口，并将它与实际接收窗口比较，随后，根据所述比较结果与阈值的偏差程度来判断所述待处理的TCP数据包是否是伪造的，从而更大概率地发现并丢弃伪造TCP数据包。

Description

一种用于处理伪造的TCP数据包的方法和系统 技术领域
本发明涉及网络安全技术领域，特别涉及一种用于处理伪造的TCP数据包的方法和系统。
背景技术
TCP(Transmission Control Protocol，传输控制协议)是一种面向连接的、可靠的、基于字节流的传输层通信协议。TCP是Internet最基本的协议，也是Internet国际互联网络的基础。随着网络技术的发展，越来越多的攻击者出于各种目的，开始利用TCP协议中的漏洞对网络进行攻击。例如，一种常用的攻击手段是伪造TCP数据包。作为示例，客户机client与服务器server在TCP三次握手后建立连接；随后，客户机client向服务器server发送请求包；劫持设备injector通过监听设备tap监听到该请求包，并向客户机client发送伪造的应答包forged packet；若不作任何处理，伪造的应答包forged packet将先于来自服务器server的真实应答包valid packet到达客户机client，从而取代服务器server与客户机client进行通信。这样，就实现了对客户机client劫持，使得客户机client以为它是与服务器server通信，但实际上却是与劫持设备injector通信。
为了提高网络安全，避免所述劫持情况的发生，用户对伪造TCP数据包的网络攻击检测提出了更高的要求。现有技术中通常采用检查IP数据包头部的TTL字段是否合理、Identification字段是否有规律等方法来发现伪造TCP数据包，并将其丢弃。但是，这些方法要么由于需要探测以提高准确度而实现复杂；要么由于简化处理而导致准确性低，容易造成误判或漏判。因此，存在对一种能够以高准确性快速简便地处理伪造的TCP数据包的方法的需求。
发明内容
本发明提供了一种改进的处理伪造的TCP数据包的方法，包括：
接收待处理的TCP数据包，所述待处理的TCP数据包头部包含窗口大小字段；
根据所述待处理的TCP数据包在TCP接收窗口对照表中查找是否存在与所述待处理的TCP数据包相关的记录；
如果所述TCP接收窗口对照表存在与所述待处理的TCP数据包相关的记 录，则从所述待处理的TCP数据包头部的窗口大小字段与所述记录中的接收窗口扩大因子字段中计算出所述待处理的TCP数据包的接收窗口值；
通过将所计算出的所述待处理的TCP数据包的接收窗口值与所述记录中的实际接收窗口值进行比较以获得它们之间的偏差；将所述偏差与预定阈值进行比较，由此判断所述TCP数据包是否为伪造包。
在本发明的又一个方面，提供了一种处理伪造的TCP数据包的系统，包括：
用于接收待处理的TCP数据包的装置，所述待处理的TCP数据包头部包含窗口大小字段；
用于根据所述待处理的TCP数据包在TCP接收窗口对照表中查找是否存在与所述待处理的TCP数据包相关的记录的装置；
用于如果所述TCP接收窗口对照表存在与所述待处理的TCP数据包相关的记录，则从所述待处理的TCP数据包头部的窗口大小字段与所述记录中的接收窗口扩大因子字段中计算出所述待处理的TCP数据包的接收窗口值的装置；
用于通过将所计算出的所述待处理的TCP数据包的接收窗口值与所述记录中的实际接收窗口值进行比较以获得它们之间的偏差的装置；
用于将所述偏差与预定阈值进行比较的装置,通过该装置的比较结果来判断所述TCP数据包是否为伪造包。
本发明的关键在于利用待处理的TCP数据包头部的窗口大小字段与窗口扩大因子(Window Scale)计算出TCP数据包的接收窗口，并将它与实际接收窗口比较，若待处理的TCP数据包的接收窗口与实际接收窗口存在较大偏差，则判断该待处理的TCP数据包为伪造的TCP数据包，并对其进行相应处理。
附图说明
在阅读通过非限制性示例示出的实现方式的以下详细描述后，可以很好地理解本发明且本发明的优点将更好地体现。附图中：
图1是TCP数据包的包头结构示意图。
图2是TCP三次握手以建立连接的过程示意图。
图3是在TCP三次握手阶段发送的SYN数据包所携带的窗口扩大因子选项结构示意图。
图4是根据本发明实施例提供的TCP接收窗口对照表中的记录的数据结构示意图。
图5是根据本发明实施例提供的一种建立和/或更新TCP接收窗口对照表的方法的流程图。
图6是根据本发明实施例的一种处理伪造的TCP数据包的方法的流程图，
具体实施方式
为使本发明的目的、技术方案及优点更加清楚明白，以下参照附图并举实施例，对本发明作进一步详细说明。
本发明提供了一种改进的处理伪造的TCP数据包的方法和系统。具体而言，本发明的关键在于利用待处理的TCP数据包头部的窗口大小字段与窗口扩大因子(Window Scale)计算出该待处理的TCP数据包的接收窗口，并将它与实际接收窗口比较，随后，根据所述比较结果与阈值的偏差程度来判断所述待处理的TCP数据包是否是伪造的，从而更大概率地发现并丢弃伪造TCP数据包。更具体而言，在本发明实施例中，通过建立至少包含TCP连接四元组(源IP、源端口、目标IP、目标端口)、实际TCP接收窗口RCV.WND和TCP接收窗口扩大因子Rcv.Wind.Scale的一个TCP接收窗口对照表，通过保证TCP连接对应的RCV.WND数值的准确性，来利用该TCP接收窗口对照表更大概率地发现(并丢弃)伪造的TCP数据包，从而确保设备尽可能少的受到伪造的TCP数据包的攻击。
首先，如图1所示，示出了TCP数据包的包头结构示意图。在其中，16位源端口号标识了主机上发起传送的应用程序；16位目标端口号标识了主机上传送要到达的应用程序。源端和目标端的端口号，用于寻找发端和收端应用进程。这两个值加上I P首部中的源端I P地址和目标端I P地址唯一确定一个T C P连接。TCP协议通过使用"端口"来标识源端和目标端的应用进程。端口号可以使用0到65535之间的任何数字。在发送服务请求时，操作系统动态地为客户端的应用程序分配端口号。在服务器端，每种服务在"众所周知的端口"(Well-Know Port)为用户提供服务。
32位序号字段，用来标识从TCP源端向TCP目标端发送的数据字节流，它表示在这个报文段中的第一个数据字节的序号。
32位确认号字段，只有ACK标志为1时，确认号字段才有效。它包含目标端所期望收到源端的下一个数据字节的序号。
4位头部长度字段：给出头部有多少个32位(4字节)。没有任何选项字段的TCP头部长度为20字节；最多可以有60字节的TCP头部。
6位保留字段：由跟在数据偏移字段后的6位构成，预留位通常为0。
标志位字段(URG、ACK、PSH、RST、SYN、FIN)：占6位。各位的含义如下：
URG：紧急指针有效。
ACK：确认序号有效。
PSH：接收方应该尽快将这个报文段交给应用层。
RST：重置连接。
SYN：发起一个连接。
FIN：释放一个连接。
16位接收窗口大小字段：此字段用来进行流量控制。单位为字节，这个值是本机期望一次接收的字节数。
16位校验和字段：对整个TCP报文段，即TCP头部和TCP数据进行校验和计算，并由目标端进行验证。
16位紧急指针字段：它是一个偏移量，和序号字段中的值相加表示紧急数据最后一个字节的序号。
选项字段：最多40字节。它可能包括"窗口扩大因子"、"时间戳"等选项。
在本发明的技术方案中，将接收窗口大小字段标记为SEG.WND，其表示发送端的接收窗口。TCP通过三次握手完成通信双方接收窗口的初始化。
在图2中，示出了TCP三次握手的过程示意图。
首先，第一次握手：客户机Client将标志位SYN置为1，随机产生一个序号SEQ＝X，并将该数据包发送给服务器Server，随后客户机Client进入SYN_SENT状态，等待服务器Server确认。
第二次握手：服务器Server收到数据包后由标志位SYN＝1知道客户机Client请求建立连接，Server将标志位SYN置为1，确认号ACK＝X+1，随机产生一个序号SEQ＝Y，并将该数据包发送给客户机Client以确认连接请求，同时服务器Server进入SYN_RCVD状态。
第三次握手：客户机Client收到确认后，检查确认号ACK是否为X+1，如果正确则将标志位ACK置为1，确认号ACK＝Y+1，将标志位SYN设置为0，随机产生一个序号SEQ＝Z，并将该数据包发送给服务器Server，服务器Server检查ACK是否为Y+1，如果正确则连接建立成功，客户机Client和服务器Server进入ESTABLISHED状态。
经过所述三次握手建立TCP连接，客户机Client与服务器Server之间就可以开始传输数据了。
通过上述结合图2的描述，可以清楚理解所述TCP的三次握手的过程。
而在图3中，示出了为上述TCP三次握手阶段所发送的SYN数据包(TCP数据包的包头的SYN标志位被置位)中携带的窗口扩大因子选项结构示意图。在该选项结构中，选项的第一个字段Kind指示选项的类型。当Kind＝3表明该选项是窗口扩大因子选项。TCP连接初始化时，通信双方使用该选项来协商接收窗口的扩大因子。在TCP的头部中，接收窗口大小是用16位表示的，故 最大为65535字节，但实际上TCP允许的接收窗口大小远不止这个数(为了提高TCP通信的吞吐量)。窗口扩大因子解决了这个问题。假设TCP头部中的接收窗口大小是N，窗口扩大因子(移位数)是M，那么TCP报文段的实际接收窗口大小是N乘2M，或者说N左移M位。注意，M的取值范围是0～14。
在该选项结构中的第二个字段Length指定该选项结构的总长度，该总长度包括Kind字段和Length字段占据的2字节。
在该选项结构中还有一个shift.cnt字段，接收窗口扩大因子Rcv.Wind.Scale的值即为该字段的值。shift.cnt取值范围为0～14，即最大TCP序号限定为216*214＝230<231。该限制用于防止字节序列号溢出。另外，接收窗口扩大因子是可选项，其值在TCP三次握手阶段通过SYN包确定。包头未设置SYN标志位的TCP数据包携带的窗口扩大因子选项会被忽略。若通信双方启用了窗口扩大，除了SYN数据包之外(其接收窗口RCV.WND等于窗口大小字段SEG.WND)，其他TCP数据包的接收窗口RCV.WND的计算方式为窗口大小字段SEG.WND左移Rcv.Wind.Scale位，即
RCV.WND＝SEG.WND<<Rcv.Wind.Scale
公式1
举例而言，如上所述，假设TCP头部中的接收窗口大小是N，窗口扩大因子(移位数)是M，那么TCP报文段的实际接收窗口大小是N乘2M，或者说N左移M位。
通常TCP连接的接收窗口RCV.WND的变化是平滑的，不会出现跳变(所谓“跳变”是指变为先前值的1.5倍及以上)。利用这个特性可以构建一个记录实际RCV.WND的TCP接收窗口对照表，通过判断一个TCP数据包的接收窗口是否符合这张表，从而推算出它是否是伪造的TCP数据包。需要说明的是，这里的实际RCV.WND即TCP第二次握手<SYN,ACK>对应的数据包的RCV.WND。
所述TCP接收窗口对照表一般被设置在网关设备上，应当理解的是，这里的网关设备也可以是诸如安全检测设备或防火墙之类的安全设备。在一种实现下，可以根据TCP第二次握手<SYN,ACK>得到的RCV.WND建立所述TCP接收窗口对照表。该TCP接收窗口对照表包含TCP连接四元组(源IP、源端口、目标IP、目标端口)、实际TCP接收窗口RCV.WND和TCP接收窗口扩大因子Rcv.Wind.Scale等主要信息。需要说明的是，该接收窗口对照表中存储的信息都是真实主机相关的信息。
在图4中，具体示出了根据本发明实施例提供的TCP接收窗口对照表中的记录的数据结构示意图。如图4所示，该对照表包括如下字段：
“键值”字段(可选)，表示根据TCP连接的四元组计算出的哈希值以方便快速查找；
“连接四元组”字段，包括源IP、源端口、目标IP、目标端口；
“实际接收窗口”字段，表示该TCP连接的实际接收窗口RCV.WND，该值可以从TCP第二次握手<SYN,ACK>对应的数据包的窗口大小字段SEG.WND得到。
“接收窗口扩大因子”字段，表示该TCP连接的接收窗口扩大因子Rcv.Wind.Scale，其可以从TCP第二次握手<SYN,ACK>对应的数据包携带的窗口扩大因子选项中的shift.cnt字段得到。
“创建时间”字段(可选)，表示该表项的创建时间。
在详细了解了所述TCP接收窗口对照表中的记录的数据结构之后，下面结合图5来详细介绍根据本发明实施例如何在TCP接收窗口对照表中创建和更新记录。
如图5所示，描述了根据本发明实施例的创建和/或更新TCP接收窗口对照表中的记录的流程图。应当理解的是，该方法可以用于网关设备、防火墙、路由器等网络设备上；并且，还应当理解的是，更新TCP接收窗口对照表包括增加、删除、修改该对照表中的记录等操作。该方法包括如下步骤：
步骤502，从接收的TCP第二次握手<SYN,ACK>对应的数据包中，提取真实的TCP连接四元组、接收窗口RCV.WND(由窗口大小字段SEG.WND得到)和接收窗口扩大因子Rcv.Wind.Scale(由窗口扩大因子选项中的shift.cnt字段得到，若没有窗口扩大因子选项，则默认值为0)；
步骤504，根据提取的连接四元组查找一TCP接收窗口对照表以确定所述TCP接收窗口对照表中是否已存在相关的记录；
步骤506，如果在所述TCP接收窗口对照表中没有查找到具有该连接四元组的记录，则根据获得的TCP连接四元组、接收窗口和接收窗口扩大因子在TCP接收窗口对照表中建立一条相关的记录；
步骤508，如果在所述TCP接收窗口对照表中已经存在具有该连接四元组的记录，则使用获得的接收窗口和接收窗口扩大因子更新该记录中的相应字段的内容，并且可选地同时更新创建时间字段。
另外，在另一个实施例中，为了节省存储空间，可定期删除TCP接收窗口对照表中创建时间距当前时间较长的陈旧记录。
另外，在另一个实施例中，为了加快查找速度，可以使用从TCP连接四元组中计算得到的键值来查找TCP接收窗口对照表。
在已经创建完成所述TCP接收窗口对照表之后，网关设备在接收到TCP 数据包(不包括SYN数据包)时，就可以根据该TCP包的连接四元组来查找TCP接收窗口对照表，如果存在具有相同连接四元组的记录，则将该TCP数据包的接收窗口RCV.WND与相关记录的接收窗口进行比较以获得它们之间的偏差，如果所述偏差超过一预定阈值，则可以怀疑该TCP数据包为伪造的TCP数据包。下面，结合图6来详细描述这一过程。
如图6所示，提供了根据本发明实施例的一种处理伪造的TCP数据包的方法的流程图，包括如下步骤：
步骤602，接收待处理的TCP数据包(不包括SYN数据包)，该待处理的TCP数据包头部包含窗口大小字段SEG.WND；
步骤604，根据该待处理的TCP数据包，例如所述待处理的TCP数据包中的连接四元组，在一TCP接收窗口对照表中查找是否存在与所述待处理的TCP数据包相关的记录，例如具有相同连接四元组的相关记录；
步骤606，在步骤604中如果在TCP接收窗口对照表中不存在具有相同连接四元组的相关记录，则过程结束
步骤608，如果TCP接收窗口对照表存在具有相同连接四元组的相关记录，则从该待处理的TCP数据包头部的窗口大小字段SEG.WND与相关记录中的接收窗口扩大因子字段Rcv.Wind.Scale中计算出该待处理的TCP数据包的接收窗口RCV.WND。具体的，该待处理的TCP数据包的接收窗口RCV.WND是根据公式1由待处理的TCP数据包头部的窗口大小字段SEG.WND与相关记录中的接收窗口扩大因子字段Rcv.Wind.Scale计算出。
步骤610，将所计算出的该待处理的TCP数据包的接收窗口RCV.WND与相关记录中的实际接收窗口RCV.WND进行比较以获得它们之间的偏差。具体的，该偏差由所计算出的该待处理的TCP数据包的接收窗口RCV.WND除以相关记录中的实际接收窗口RCV.WND得到；
步骤612，将所述偏差与一预定阈值进行比较，并且：
如果所述偏差超过该预定阈值，则说明所述待处理的TCP数据包很有可能是伪造的TCP数据包，方法进入步骤614，以针对该待处理的TCP数据包执行相应的处理，例如直接丢弃该待处理的TCP数据包，或者可以向用户提供相关提示让用户来进一步辨别该待处理的TCP数据包的真伪等等；
如果所述偏差没有超过该预定阈值，则说明该待处理的TCP数据包应该是真实的TCP数据包，因而，进入步骤616以允许所述待处理的TCP数据包直接通过所述网关设备。
需要说明的是，为了尽量避免将有效的TCP数据包作为伪造的TCP数据包丢弃，优选地，“预定阈值”指的是该TCP数据包的RCV.WND值是相关记 录中的实际RCV.WND值的倍数，根据实验，所述“预定阈值”的取值范围可以是≧1.5，也即当所述偏差超过1.5倍时就可以初步确定所述TCP数据包是伪造的TCP数据包。而在较佳实施例中，所述“预定阈值”较佳地为4倍，即当所述偏差超过4倍时将所述TCP数据包确定为伪造的TCP数据包，该“预定阈值”可以使得所述TCP伪造包的判断更加准确。但所述倍数仅仅是出于说明的目的，并非限制性的。用户可以根据实际情况来调整所述“预定阈值”标准以适应不同的上下文环境需求。
综上所述，在本发明的方案中，通过判断待处理的TCP数据包的接收窗口是否与TCP接收窗口对照表中的相关记录的实际接收窗口有较大偏差来实现更大概率地发现(丢弃)伪造的TCP数据包，从而保证了设备尽可能少的受到伪造的TCP数据包的攻击。
本发明的方案不仅适用于防火墙、DDoS类网关系统和旁路的类似IDS检测系统，还适用于在路由器上使用。
以上所述仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。凡在本发明的精神和原则之内所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (14)

  1. 一种处理伪造的TCP数据包的方法，包括如下步骤：
    接收待处理的TCP数据包，所述待处理的TCP数据包头部包含窗口大小字段；
    根据所述待处理的TCP数据包在TCP接收窗口对照表中查找是否存在与所述待处理的TCP数据包相关的记录；
    如果所述TCP接收窗口对照表存在与所述待处理的TCP数据包相关的记录，则从所述待处理的TCP数据包头部的窗口大小字段与所述记录中的接收窗口扩大因子字段中计算出所述待处理的TCP数据包的接收窗口值；
    通过将所计算出的所述待处理的TCP数据包的接收窗口值与所述记录中的实际接收窗口值进行比较以获得它们之间的偏差；
    将所述偏差与预定阈值进行比较，由此判断所述TCP数据包是否为伪造包。
  2. 根据权利要求1所述的方法，其特征在于，将所述偏差与预定阈值进行比较，由此判断所述TCP数据包是否为伪造包的步骤包括：
    如果所述偏差超过所述预定阈值，则针对所述待处理的TCP数据包执行相应的处理；
    如果所述偏差不超过所述预定阈值，则允许所述待处理的TCP数据包通过。
  3. 如权利要求1所述的方法，其特征在于，所述待处理的TCP数据包的接收窗口值RCV.WND是根据下述公式计算出的：
    RCV.WND＝SEG.WND<<Rcv.Wind.Scale
    其中SEG.WND表示窗口大小，而Rcv.Wind.Scale表示接收窗口扩大因子。
  4. 如权利要求1所述的方法，其特征在于，所述TCP接收窗口对照表中的记录包括下述字段：
    “连接四元组”字段，包括源IP、源端口、目标IP、目标端口；
    “实际接收窗口”字段，表示所述TCP连接的实际接收窗口值，该值可以例如从TCP第二次握手对应的数据包的窗口大小字段得到；
    “接收窗口扩大因子”字段，表示所述TCP连接的接收窗口扩大因子，其可以从TCP第二次握手对应的数据包携带的窗口扩大因子选项中的shift.cnt字段得到。
  5. 根据权利要求4所述的方法，其特征在于，所述TCP接收窗口对照表中的记录还包括下述字段：
    可选的“键值”字段，表示根据TCP连接的四元组计算出的哈希值以方便 快速查找；
    可选的“创建时间”字段，表示该记录的创建时间。
  6. 根据权利要求4所述的方法，其特征在于，所述根据待处理的TCP数据包在所述TCP接收窗口对照表中查找与所述待处理的TCP数据包相关的记录的步骤包括：
    根据所述待处理的TCP数据包的连接四元组在一TCP接收窗口对照表中查找是否存在与所述待处理的TCP数据包相关的记录。
  7. 根据权利要求5所述的方法，其特征在于，所述根据待处理的TCP数据包在所述TCP接收窗口对照表中查找与所述待处理的TCP数据包相关的记录的步骤包括：
    以所述待处理的TCP数据包的连接四元组计算出的哈希值作为查询条件，与所述TCP接收窗口对照表中的键值进行比较从而查找是否存在与所述待处理的TCP数据包相关的记录。
  8. 如权利要求4或5所述的方法，其特征在于，所述TCP接收窗口对照表中的记录是通过下述步骤创建的：
    从接收的TCP第二次握手对应的数据包中，提取真实的TCP连接四元组、接收窗口值和接收窗口扩大因子，其中若没有所述窗口扩大因子选项，则默认值为0；
    根据获得的连接四元组查找一TCP接收窗口对照表以确定所述TCP接收窗口对照表中是否已存在与所述数据包相关的记录：
    如果在所述TCP接收窗口对照表中没有查找到具有该连接四元组的记录，则根据获得的TCP连接四元组、接收窗口值和接收窗口扩大因子在所述TCP接收窗口对照表中建立一条与所述数据包相关的记录；
    如果在所述TCP接收窗口对照表中已经存在具有该连接四元组的记录，则使用获得的接收窗口值和接收窗口扩大因子更新所述记录中的相应字段的内容，同时更新创建时间字段。
  9. 如权利要求1所述的方法，其特征在于，如果所述偏差超过所述预定阈值，则针对所述待处理的TCP数据包执行相应的处理的步骤还包括：
    直接丢弃所述待处理的TCP数据包；或者
    向用户提供相关提示，以便让所述用户来进一步辨别所述待处理的TCP数据包的真伪。
  10. 如权利要求1所述的方法，其特征在于，其中，所述偏差定义为所述待处理的TCP数据包的接收窗口值除以所述与所述待处理的TCP数据包相关的记录中的实际接收窗口值得到的倍数；并且
    所述预定阈值是指所述待处理的TCP数据包的接收窗口值是所述与所述待处理的TCP数据包相关的记录中的实际接收窗口值的倍数，其中所述预定阈值的取值范围可以是≧1.5，更优选地为≧4。
  11. 如权利要求5所述的方法，其特征在于，根据所述TCP接收窗口对照表中的记录的“创建时间”字段，定期删除所述TCP接收窗口对照表中创建时间距当前时间较长的陈旧记录。
  12. 根据权利要求1所述的方法，其特征在于，如果在所述TCP接收窗口对照表中不存在与所述待处理的TCP数据包相关的记录，则允许所述待处理的TCP数据包直接通过。
  13. 一种处理伪造的TCP数据包的系统，包括：
    用于接收待处理的TCP数据包的装置，所述待处理的TCP数据包头部包含窗口大小字段；
    用于根据所述待处理的TCP数据包在TCP接收窗口对照表中查找是否存在与所述待处理的TCP数据包相关的记录的装置；
    用于如果所述TCP接收窗口对照表存在与所述待处理的TCP数据包相关的记录，则从所述待处理的TCP数据包头部的窗口大小字段与所述记录中的接收窗口扩大因子字段中计算出所述待处理的TCP数据包的接收窗口值的装置；
    用于通过将所计算出的所述待处理的TCP数据包的接收窗口值与所述记录中的实际接收窗口值进行比较以获得它们之间的偏差的装置；
    用于将所述偏差与预定阈值进行比较的装置，通过该装置的比较结果来判断所述TCP数据包是否为伪造包。
  14. 根据权利要求13所述的系统，其特征在于，用于将所述偏差与一预定阈值进行比较的装置，通过该装置的比较结果来判断所述TCP数据包是否为伪造包的步骤包括：
    如果所述偏差超过所述预定阈值，则针对所述待处理的TCP数据包执行相应的处理；
    如果所述偏差不超过所述预定阈值，则允许所述待处理的TCP数据包通过。
PCT/CN2016/104103 2016-08-26 2016-10-31 一种用于处理伪造的tcp数据包的方法和系统 Ceased WO2018035962A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16913982.1A EP3432533B1 (en) 2016-08-26 2016-10-31 Method and system for processing forged tcp data packet
US16/068,797 US10834126B2 (en) 2016-08-26 2016-10-31 Method and system for processing forged TCP packet

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610743506.0A CN106101161B (zh) 2016-08-26 2016-08-26 一种用于处理伪造的tcp数据包的方法和系统
CN201610743506.0 2016-08-26

Publications (1)

Publication Number Publication Date
WO2018035962A1 true WO2018035962A1 (zh) 2018-03-01

Family

ID=57223830

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/104103 Ceased WO2018035962A1 (zh) 2016-08-26 2016-10-31 一种用于处理伪造的tcp数据包的方法和系统

Country Status (4)

Country Link
US (1) US10834126B2 (zh)
EP (1) EP3432533B1 (zh)
CN (1) CN106101161B (zh)
WO (1) WO2018035962A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106027390B (zh) * 2016-05-13 2019-11-26 湖南基石通信技术有限公司 多参数优化olsr协议的方法及装置
CN106101161B (zh) 2016-08-26 2019-02-01 网宿科技股份有限公司 一种用于处理伪造的tcp数据包的方法和系统
CN107277027B (zh) * 2017-06-30 2020-10-16 北京知道未来信息技术有限公司 一种旁路抢答设备识别方法及流量清洗方法
CN109040112B (zh) * 2018-09-04 2020-01-03 北京明朝万达科技股份有限公司 网络控制方法和装置
CN109802937B (zh) * 2018-11-30 2021-08-17 浙江远望信息股份有限公司 一种发现对智能终端设备tcp下ip欺骗攻击的方法
DE102019104983B4 (de) * 2019-02-27 2020-10-01 Eq-3 Holding Gmbh Verfahren zur Übertragung von Daten in Datenpaketen sowie Datenkommunikationsanordnung, Transceiver und Computerprogrammprodukt hierzu
US20220053018A1 (en) * 2020-08-11 2022-02-17 Flipkart Internet Private Limited System and method for detection and mitigation of a dos/ddos attack
CN117692396B (zh) * 2024-02-04 2024-04-26 湖南国科亿存信息科技有限公司 一种复杂网络环境下的tcp单边加速方法及装置
CN120281804B (zh) * 2025-04-28 2026-01-09 深圳市啪啪运动科技有限公司 基于多tcp连接的体育场馆通信方法、系统及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009059545A1 (en) * 2007-10-30 2009-05-14 Huawei Technologies Co., Ltd. A data transmission method, device and system
US7607170B2 (en) * 2004-12-22 2009-10-20 Radware Ltd. Stateful attack protection
CN101989985A (zh) * 2010-10-09 2011-03-23 北京工商大学 一种基于硬件的核心路由器tcp连接状态维护模块设计方案
CN102655509A (zh) * 2012-05-07 2012-09-05 福建星网锐捷网络有限公司 一种网络攻击识别方法及装置
CN105847283A (zh) * 2016-05-13 2016-08-10 深圳市傲天科技股份有限公司 一种基于信息熵方差分析的异常流量检测方法
CN106101161A (zh) * 2016-08-26 2016-11-09 网宿科技股份有限公司 一种用于处理伪造的tcp数据包的方法和系统

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7949732B1 (en) * 2003-05-12 2011-05-24 Sourcefire, Inc. Systems and methods for determining characteristics of a network and enforcing policy
US7472416B2 (en) * 2004-01-09 2008-12-30 Cisco Technology, Inc. Preventing network reset denial of service attacks using embedded authentication information
US7565694B2 (en) * 2004-10-05 2009-07-21 Cisco Technology, Inc. Method and apparatus for preventing network reset attacks
US8363549B1 (en) * 2009-09-02 2013-01-29 Juniper Networks, Inc. Adaptively maintaining sequence numbers on high availability peers
US8730799B2 (en) 2010-03-03 2014-05-20 Akamai Technologies, Inc. Dynamic adjustment of receive window utilized by a transmitting device
JP5258938B2 (ja) 2011-07-26 2013-08-07 株式会社日立製作所 通信装置
US10027761B2 (en) * 2013-05-03 2018-07-17 A10 Networks, Inc. Facilitating a secure 3 party network session by a network device
CN103475706B (zh) * 2013-09-09 2016-06-29 中国科学技术大学苏州研究院 基于syn-ack双服务器反弹模式的伪tcp隐蔽通信方法
US10397379B2 (en) * 2015-03-06 2019-08-27 Apple Inc. Robust multipath TCP stateless connection establishment

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7607170B2 (en) * 2004-12-22 2009-10-20 Radware Ltd. Stateful attack protection
WO2009059545A1 (en) * 2007-10-30 2009-05-14 Huawei Technologies Co., Ltd. A data transmission method, device and system
CN101989985A (zh) * 2010-10-09 2011-03-23 北京工商大学 一种基于硬件的核心路由器tcp连接状态维护模块设计方案
CN102655509A (zh) * 2012-05-07 2012-09-05 福建星网锐捷网络有限公司 一种网络攻击识别方法及装置
CN105847283A (zh) * 2016-05-13 2016-08-10 深圳市傲天科技股份有限公司 一种基于信息熵方差分析的异常流量检测方法
CN106101161A (zh) * 2016-08-26 2016-11-09 网宿科技股份有限公司 一种用于处理伪造的tcp数据包的方法和系统

Also Published As

Publication number Publication date
US10834126B2 (en) 2020-11-10
EP3432533B1 (en) 2020-07-22
CN106101161A (zh) 2016-11-09
CN106101161B (zh) 2019-02-01
US20190020681A1 (en) 2019-01-17
EP3432533A4 (en) 2019-06-19
EP3432533A1 (en) 2019-01-23

Similar Documents

Publication Publication Date Title
WO2018035962A1 (zh) 一种用于处理伪造的tcp数据包的方法和系统
US8224976B2 (en) Using a server&#39;s capability profile to establish a connection
US7738495B2 (en) Method of determining a maximum transmission unit value of a network path using transport layer feedback
US7471681B2 (en) Determining network path transmission unit
US8499146B2 (en) Method and device for preventing network attacks
US7181612B1 (en) Facilitating IPsec communications through devices that employ address translation in a telecommunications network
WO2011029357A1 (zh) 认证通信流量的方法、通信系统和防护装置
WO2010063228A1 (zh) 防御域名系统欺骗攻击的方法及装置
Thornburgh Adobe's Secure Real-Time Media Flow Protocol
EP1941651B1 (en) Approaches for automatically switching message authentication keys
US20060221946A1 (en) Connection establishment on a tcp offload engine
US7545810B2 (en) Approaches for switching transport protocol connection keys
US12323469B1 (en) Zero network-profile cryptographically secure network port access
US7623450B2 (en) Methods and apparatus for improving security while transmitting a data packet
CN103457803B (zh) 一种点对点流量识别装置和方法
CN102655509A (zh) 一种网络攻击识别方法及装置
CN106878326A (zh) 基于反向检测的IPv6邻居缓存保护方法及其装置
JP2017538335A (ja) プロトコルスタックがないモードにおけるｔｃｐの中間者処理方法
US9106479B1 (en) System and method for managing network communications
CN102427452B (zh) 同步报文发送方法、装置和网络设备
CN106254384B (zh) 一种服务访问方法及装置
CN112559824A (zh) 报文处理方法、装置和设备
CN112153001B (zh) 基于waf的网络通信方法、系统、电子装置和存储介质
CN110381007A (zh) Tcp加速方法及装置
CN116232690A (zh) Ddos攻击的抵抗方法、装置、智能网卡、介质及产品

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2016913982

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2016913982

Country of ref document: EP

Effective date: 20181019

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16913982

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE