NETWORK ATTACK DETECTION METHOD

• US 20160105453A1
• Filed: 04/16/2015
• Published: 04/14/2016
• Est. Priority Date: 10/10/2014
• Status: Active Grant

• Current Assignee: Hong Kong Polytechnic University, Tencent Technology Company Limited (Tencent Holdings Limited)
• Original Assignee: Hong Kong Polytechnic University, Tencent Technology Company Limited (Tencent Holdings Limited)
• Inventors: Zou, Xianneng, Xue, Lei, Liu, Zhiwei, Hou, Jingang, Luo, Xiapu, Chan, Edmond W. W, Tu, Pei, Shao, Yuru
• Granted Patent: US 9,876,807 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

It is described a network attack detection method. A topology analysis on network is conducted to obtain a probing path set containing at least one probing path. A first probing path contained in the probing path set is probed by using a probing pattern to obtain a performance metric of the first probing path. It is determined whether the first probing path is subjected to network attack according to the performance metric and a control performance metric.

Claims

1. A method, comprising:

at an electronic device having one or more processors, and a memory for storing program instructions that are executed by the one or more processors,

conducting a topology analysis on network, and obtaining a probing path set containing at least one probing path according to the topology analysis;

probing a first probing path contained in the probing path set by using a probing pattern and obtaining a performance metric of the first probing path; and

determining whether the first probing path is subjected to network attack according to the performance metric and a control performance metric,

wherein one end of the probing path is a probing node and another end of the probing path is a target node, a forward path of the probing path is from the probing node to the target node and a reverse path of the probing path is from the target node to the probing node.

2. The method according to claim 1, wherein the probing pattern is Round Trip Probing (RTP),

wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending at least two RTP probing packets from the probing node to the target node;

receiving RTP response packets in responsive to the RTP probing packets from the target node of the first probing path, each RTP response packet having a sequence number and an ACK number; and

according to the sequence numbers and the ACK numbers of the RTP response packets, determining one or more of the following performance metric of the first probing path;

a RTP packet loss rate on the forward path, a RTP loss pair rate on the forward path, a RTP packet reordering rate on the forward path, a RTP packet loss rate on the reverse path, a RTP packet reordering rate on the reverse path, and a RTP loss pair rate on the reverse path,

wherein a packet pair on the forward path consists of an a^th RTP probing packet and an a+1^th RTP probing packet, a packet pair on the reverse path consists of an a^th RTP response packet and an a+1^th RTP response packet, the a^th RTP probing packet corresponds to the a^th RTP response packet.

3. The method according to claim 2, wherein the performance metric further comprises Round Trip Time (RTT) and/or RTT jitter,

wherein the RTT is determined according to a sending time of a RTP probing packet and an arrival time of a corresponding RTP response packet,

wherein the RTT jitter is determined according to multiple RTTs.

4. The method according to claim 1, wherein the probing pattern is Two Way Probing (TWP), wherein the performance metric of the first probing path comprises available bandwidth on the reverse path,

wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending a first TWP probing packet with 0 advertising window and a second TWP probing packet with w advertising windows from the probing node to the target node, wherein each advertising window is equal to 2 Maximal Segment Size (MSS), wherein w is an integer equal to or greater than 2;

receiving w TWP response packets in responsive to the second TWP probing packet from the target node of the first probing path;

determining a time gap G_r between an arrival time of the first TWP response packet and an arrival time of the w^th TWP response packet; and

calculating the available bandwidth on the reverse path according to w, G_r and MSS.

5. The method according to claim 4, wherein each TWP response packet has a sequence number and an ACK number, based on which it is determined one or more of the following performance metric of the first probing path:

a TWP packet loss rate on the forward path, a TWP loss pair rate on the forward path, a TWP packet reordering rate on the forward path, a TWP packet loss rate on the reverse path, a TWP packet reordering rate on the reverse path, and a TWP loss pair rate on the reverse path,

wherein a packet pair on the forward path consists of the first TWP probing packet and the second TWP probing packet, a packet pair on the reverse path consists of an a^th TWP response packet and an a+1^th TWP response packet.

6. The method according to claim 4, wherein the performance metric further comprises Round Trip Time (RTT) and/or RTT jitter,

wherein the RTT is determined according to a sending time of a TWP probing packet and an arrival time of a corresponding TWP response packet,

wherein the RTT jitter is determined according to multiple RTTs.

7. The method according to claim 1, wherein the probing pattern is modified Recursive Packet Train (mRPT), wherein the performance metric of the first probing path comprises available bandwidth on the forward path,

wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending a mRPT probing packet train from the probing node to the target node, wherein the mRPT probing packet train contains a first sub-probing packet, N_L load packets and a second sub-probing packet in sequence, wherein N_L is an integer equal to or greater than 1;

receiving a first ACK packet in responsive to the first sub-probing packet and a second ACK packet in responsive to the second sub-probing packet from the target node;

determining a time gap G_A between an arrival time of the first ACK packet and an arrival time of the second ACK packet; and

calculating the available bandwidth on the forward path according to N_L, G_A and S_L, where S_L is the size of a load packet.

8. The method according to claim 7, wherein the performance metric further comprises RTT and/or RTT jitter,

wherein the RTT is determined according to a sending time of a sub-probing packet and an arrival time of a corresponding ACK packet,

wherein the RTT jitter is determined according to multiple RTTs.

9. The method according to claim 7, further comprising:

in the case it is determined the first probing path is subjected to the network attack, determining hop-by-hop a target link which is under the network attack on the first probing path.

10. The method according to claim 1, further comprising:

after obtaining the performance metric of the first probing path, forming a metric vector according to the obtained performance metric,

wherein the determining whether the first probing path is subjected to network attack according to the performance metric and a control performance metric comprises;

calculating a Mahalanobis distance according the formed metric vector and a control metric vector formed based on the control performance metric; and

determining whether the first probing path is subjected to the network attack according to the calculated Mahalanobis distance,

wherein the metric vector is for the forward path or for the reverse path.

11. The method according to claim 1, further comprising:

before probing the first probing path, setting up a connection between the probing node and the target node; and

determining a connection failure rate between the probing node and the target node within a preset time.

12. A non-transitory computer-readable storage medium storing instructions thereon for execution by at least one processing circuit, the instructions comprising:

conducting a topology analysis on network, and obtaining a probing path set containing at least one probing path according to the topology analysis;

probing a first probing path contained in the probing path set by using a probing pattern and obtaining a performance metric of the first probing path; and

determining whether the first probing path is subjected to network attack according to the performance metric and a control performance metric,

wherein one end of the probing path is a probing node and another end of the probing path is a target node, a forward path of the probing path is from the probing node to the target node and a reverse path of the probing path is from the target node to the probing node.

13. The non-transitory computer-readable storage medium according to claim 12, wherein the probing pattern is Round Trip Probing (RTP),

wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending at least two RTP probing packets from the probing node to the target node;

receiving RTP response packets in responsive to the RTP probing packets from the target node of the first probing path, each RTP response packet having a sequence number and an ACK number; and

according to the sequence numbers and the ACK numbers of the RTP response packets, determining one or more of the following performance metric of the first probing path;

a RTP packet loss rate on the forward path, a RTP loss pair rate on the forward path, a RTP packet reordering rate on the forward path, a RTP packet loss rate on the reverse path, a RTP packet reordering rate on the reverse path, and a RTP loss pair rate on the reverse path,

wherein a packet pair on the forward path consists of an a^th RTP probing packet and an a+1^th RTP probing packet, a packet pair on the reverse path consists of an a^th RTP response packet and an a+1^th RTP response packet, the a^th RTP probing packet corresponds to the a^th RTP response packet.

14. The non-transitory computer-readable storage medium according to claim 12, wherein the probing pattern is Two Way Probing (TWP), wherein the performance metric of the first probing path comprises available bandwidth on the reverse path,

wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending a first TWP probing packet with 0 advertising window and a second TWP probing packet with w advertising windows from the probing node to the target node, wherein each advertising window is equal to 2 Maximal Segment Size (MSS), wherein w is an integer equal to or greater than 2;

receiving w TWP response packets in responsive to the second TWP probing packet from the target node of the first probing path;

determining a time gap G_r between an arrival time of the first TWP response packet and an arrival time of the w^th TWP response packet; and

calculating the available bandwidth on the reverse path according to w, G_r and MSS.

15. The non-transitory computer-readable storage medium according to claim 12, wherein the probing pattern is modified Recursive Packet Train (mRPT), wherein the performance metric of the first probing path comprises available bandwidth on the forward path,

wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending a mRPT probing packet train from the probing node to the target node, wherein the mRPT probing packet train contains a first sub-probing packet, N_L load packets and a second sub-probing packet in sequence, wherein N_L is an integer equal to or greater than 1;

receiving a first ACK packet in responsive to the first sub-probing packet and a second ACK packet in responsive to the second sub-probing packet from the target node;

determining a time gap G_A between an arrival time of the first ACK packet and an arrival time of the second ACK packet; and

calculating the available bandwidth on the forward path according to N_L, G_A and S_L, where S_L is the size of a load packet.

16. The non-transitory computer-readable storage medium according to claim 15, wherein the instructions further comprise:

in the case it is determined the first probing path is subjected to the network attack, determining hop-by-hop a target link which is under the network attack on the first probing path.

17. An apparatus, comprising:

one or more processors;

a memory coupled to the one or more processors; and

instructions stored in the memory, the instructions being executable by the one or more processors to;

conduct a topology analysis on network, and obtain a probing path set containing at least one probing path according to the topology analysis;

probe a first probing path contained in the probing path set by using a probing pattern and obtain a performance metric of the first probing path; and

determine whether the first probing path is subjected to network attack according to the performance metric and a control performance metric,

wherein one end of the probing path is a probing node and another end of the probing path is a target node, a forward path of the probing path is from the probing node to the target node and a reverse path of the probing path is from the target node to the probing node.

18. The apparatus according to claim 17, wherein the probing pattern is Round Trip Probing (RTP),

wherein probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending at least two RTP probing packets from the probing node to the target node;

receiving RTP response packets in responsive to the RTP probing packets from the target node of the first probing path, each RTP response packet having a sequence number and an ACK number; and

according to the sequence numbers and the ACK numbers of the RTP response packets, determining one or more of the following performance metric of the first probing path;

a RTP packet loss rate on the forward path, a RTP loss pair rate on the forward path, a RTP packet reordering rate on the forward path, a RTP packet loss rate on the reverse path, a RTP packet reordering rate on the reverse path, and a RTP loss pair rate on the reverse path,

wherein a packet pair on the forward path consists of an a^th RTP probing packet and an a+1^th RTP probing packet, a packet pair on the reverse path consists of an a^th RTP response packet and an a+1^th RTP response packet, the a^th RTP probing packet corresponds to the a^th RTP response packet.

19. The apparatus according to claim 17, wherein the probing pattern is Two Way Probing (TWP), wherein the performance metric of the first probing path comprises available bandwidth on the reverse path,

wherein probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending a first TWP probing packet with 0 advertising window and a second TWP probing packet with w advertising windows from the probing node to the target node, wherein each advertising window is equal to 2 Maximal Segment Size (MSS), wherein w is an integer equal to or greater than 2;

receiving w TWP response packets in responsive to the second TWP probing packet from the target node of the first probing path;

determining a time gap G_r between an arrival time of the first TWP response packet and an arrival time of the w^th TWP response packet; and

calculating the available bandwidth on the reverse path according to w, G_r and MSS.

20. The apparatus according to claim 17,

wherein the probing pattern is modified Recursive Packet Train (mRPT), wherein the performance metric of the first probing path comprises available bandwidth on the forward path,

wherein probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:

sending a mRPT probing packet train from the probing node to the target node, wherein the mRPT probing packet train contains a first sub-probing packet, N_L load packets and a second sub-probing packet in sequence, wherein N_L is an integer equal to or greater than 1;

receiving a first ACK packet in responsive to the first sub-probing packet and a second ACK packet in responsive to the second sub-probing packet from the target node;

determining a time gap G_A between an arrival time of the first ACK packet and an arrival time of the second ACK packet; and

calculating the available bandwidth on the forward path according to N_L, G_A and S_L, where S_L is the size of a load packet.