Network attack detection method

Patent metadata

Field	Value
Publication number	US-9876807-B2
Application number	US-201514688554-A
Country	US
Kind code	B2
Filing date	Apr 16, 2015
Priority date	Oct 10, 2014
Publication date	Jan 23, 2018
Grant date	Jan 23, 2018

Abstract

It is described a network attack detection method. A topology analysis on network is conducted to obtain a probing path set containing at least one probing path. A first probing path contained in the probing path set is probed by using a probing pattern to obtain a performance metric of the first probing path. It is determined whether the first probing path is subjected to network attack according to the performance metric and a control performance metric.

First claim

The invention claimed is:

1. A method, comprising:
at an electronic device having one or more processors, and a memory for storing program instructions that are executed by the one or more processors,
conducting a topology analysis on network, and obtaining a probing path set containing at least one probing path according to the topology analysis;
probing a first probing path contained in the probing path set by using a probing pattern and obtaining a performance metric of the first probing path; and
determining whether the first probing path is subjected to network attack according to the performance metric and a control performance metric,
wherein one end of the probing path is a probing node and another end of the probing path is a target node, a forward path of the probing path is from the probing node to the target node and a reverse path of the probing path is from the target node to the probing node,
wherein the probing pattern is modified Recursive Packet Train (mRPT), wherein the performance metric of the first probing path comprises available bandwidth on the forward path,
wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:
sending a mRPT probing packet train from the probing node to the target node, wherein the mRPT probing packet train contains a first sub-probing packet, N L load packets and a second sub-probing packet in sequence, wherein N L is an integer equal to or greater than 1;
receiving a first ACK packet in responsive to the first sub-probing packet and a second ACK packet in responsive to the second sub-probing packet from the target node;
determining a time gap G A between an arrival time of the first ACK packet and an arrival time of the second ACK packet; and
calculating the available bandwidth on the forward path according to N L , G A and S L , where S L is the size of a load packet.

2. The method according to claim 1 , wherein the performance metric further comprises RTT and/or RTT jitter,
wherein the RTT is determined according to a sending time of a sub-probing packet and an arrival time of a corresponding ACK packet,
wherein the RTT jitter is determined according to multiple RTTs.

3. The method according to claim 1 , further comprising:
in the case it is determined the first probing path is subjected to the network attack, determining hop-by-hop a target link which is under the network attack on the first probing path.

4. The method according to claim 1 , further comprising: after obtaining the performance metric of the first probing path, forming a metric vector according to the obtained performance metric,
wherein the determining whether the first probing path is subjected to network attack according to the performance metric and a control performance metric comprises:
calculating a Mahalanobis distance according the formed metric vector and a control metric vector formed based on the control performance metric; and
determining whether the first probing path is subjected to the network attack according to the calculated Mahalanobis distance,
wherein the metric vector is for the forward path or for the reverse path.

5. The method according to claim 1 , further comprising:
before probing the first probing path, setting up a connection between the probing node and the target node; and
determining a connection failure rate between the probing node and the target node within a preset time.

6. A non-transitory computer-readable storage medium storing instructions thereon for execution by at least one processing circuit, the instructions comprising:
conducting a topology analysis on network, and obtaining a probing path set containing at least one probing path according to the topology analysis;
probing a first probing path contained in the probing path set by using a probing pattern and obtaining a performance metric of the first probing path; and
determining whether the first probing path is subjected to network attack according to the performance metric and a control performance metric,
wherein one end of the probing path is a probing node and another end of the probing path is a target node, a forward path of the probing path is from the probing node to the target node and a reverse path of the probing path is from the target node to the probing node,
wherein the probing pattern is modified Recursive Packet Train (mRPT), wherein the performance metric of the first probing path comprises available bandwidth on the forward path,
wherein the probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:
sending a mRPT probing packet train from the probing node to the target node, wherein the mRPT probing packet train contains a first sub-probing packet, N L load packets and a second sub-probing packet in sequence, wherein N L is an integer equal to or greater than 1;
receiving a first ACK packet in responsive to the first sub-probing packet and a second ACK packet in responsive to the second sub-probing packet from the target node;
determining a time gap G A between an arrival time of the first ACK packet and an arrival time of the second ACK packet; and
calculating the available bandwidth on the forward path according to N L , G A and S L , where S L is the size of a load packet.

7. The non-transitory computer-readable storage medium according to claim 6 , wherein the instructions further comprise:
in the case it is determined the first probing path is subjected to the network attack, determining hop-by-hop a target link which is under the network attack on the first probing path.

8. An apparatus, comprising:
one or more processors; and
a memory coupled to the one or more processors;
instructions stored in the memory, the instructions being executable by the one or more processors to:
conduct a topology analysis on network, and obtain a probing path set containing at least one probing path according to the topology analysis;
probe a first probing path contained in the probing path set by using a probing pattern and obtain a performance metric of the first probing path; and
determine whether the first probing path is subjected to network attack according to the performance metric and a control performance metric,
wherein one end of the probing path is a probing node and another end of the probing path is a target node, a forward path of the probing path is from the probing node to the target node and a reverse path of the probing path is from the target node to the probing node,
wherein the probing pattern is modified Recursive Packet Train (mRPT), wherein the performance metric of the first probing path comprises available bandwidth on the forward path,
wherein probing a first probing path by using a probing pattern and obtaining a performance metric of the first probing path comprises:
sending a mRPT probing packet train from the probing node to the target node, wherein the mRPT probing packet train contains a first sub-probing packet, N L load packets and a second sub-probing packet in sequence, wherein N L is an integer equal to or greater than 1;
receiving a first ACK packet in responsive to the first sub-probing packet and a second ACK packet in responsive to the second sub-probing packet from the target node;
determining a time gap G A between an arrival time of the first ACK packet and an arrival time of the second ACK packet; and
calculating the available bandwidth on the forward path according to N L , G A and S L , where S L is the size of a load packet.

Assignees

• Univ Hong Kong Polytechnic
• Tencent Tech Shenzhen Co Ltd

Inventors

• Xue Lei
• Liu Zhiwei
• Zou Xianneng
• Hou Jingang
• Luo Xiapu
• Chan Edmond W W
• Tu Pei
• Shao Yuru

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L43/087

  Jitter · CPC title

• H04L43/0894

  Packet rate · CPC title

• H04L43/0829

  Packet loss · CPC title