DETECTION METHOD FOR NETWORK PENETRATING BEHAVIOR BASED ON COMMUNICATION FINGERPRINT

Transcription

1 DETECTION METHOD FOR NETWORK PENETRATING BEHAVIOR BASED ON COMMUNICATION FINGERPRINT 1 ZHANGGUO TANG, 2 HUANZHOU LI, 3 MINGQUAN ZHONG, 4 JIAN ZHANG 1 Institute of Computer Network and Communiation Tehnology, Sihuan Normal University, Chengdu , China 1 tanghangguo@sinu.edu.n ABSTRACT In order to monitor the use of network transmission software, the network penetrating tehnique based on enrypted proxy is disussed. By omparing the behavior of related penetration software, the onept of ommuniation fingerprint is introdued to expand the extension of the ommuniation features. The fingerprints database of enrypted proxy software with speifi harateristis is onstruted, and a heuristi identifiation system for enrypted proxy software is designed and implemented. Test results indiate that the system runs effiiently and the results are aurate. Keywords: Proxy; Enrypted Proxy; Network Penetrating; Communiation Fingerprint; Network 1. INTRODUCTION With the rapid development of Internet, It is partiularly important to ontrol Information and ontent on the Internet. However, in reent years a lass of Internet penetration software appeared. Through dynamially proxy server, it an send the enrypted information, and thereby breakthrough Internet blokade so as to avoid supervision. Network penetration tehnique generally integrated with agent tehnology, enrypted tunnel tehnology, multi-hop tehnology, anonymous ommuniation tehnology[1,2], it an not only break through the existing safety devie to aess illegal websites, but also sent attak ode, seret data to the destination host. Therefore, the researh of network penetration tehnology and the orresponding monitoring measures is of great realisti signifiane. In order to prevent the spread of harmful information, generally the firewall is arranged between in the trust and distrust network, whih is used for sensitive ontent filtering suh as websites, IP address, key words and URL. However, the weakness of these filtering tehniques is powerless to the enrypted information, and the keyword of URL or webpage an be used to enrypt by different methods, so that suh information filtering system is fundamentally out of ation [3]. In this paper, we fous on the working priniple of enrypted proxy. Through the analysis and summariation of ommuniation proess and behavior of suh software, we mastered the working mehanism and ommuniation fingerprint, on that basis, the generi detetion sheme of suh software was designed. The rest of this paper is organied as follows: Setion 2 addresses related work of network penetrating behavior and enrypted proxy tehnology. Setion 3 desribes the bakground of ommuniation fingerprint. Our detetion approah and key tehnologies rare also explained in setion 3. Experiments are explained in setion4, followed by onlusions and future work in setion RELATED WORK 2.1enrypted proxy tehnology The network penetration proess based on the enrypted proxy is shown in Figure 1. Enrypted proxy server was plaed between the inseure network environment and safe network environment, only when the enrypted ommuniation both use the same protool, the enryption server port an be onneted and aessed by lient[4,5,6]. To implement the information transmitting and plaintext-iphertext onversion between appliation program and enrypted server, the lient needs to run the enrypted proxy software, and through the use of network ryptosystem in the seure hannel it an provide ustomers with safe and reliable data. 2.2The omparison of existing enrypted proxy tehnology and tools In order to evaluate the enryption software penetrating ability, we must first understand the different network ontent filtering priniple [7]. 82

2 Table 1 gives the three main kinds of filtering methods and the orresponding penetration Firewall tehnology. diret aess, unreahable Client (Enrypted proxy software) through a proxy server to aess, reahable Enrypted proxy server through a proxy server to aess, reahable Figure 1 Shemati diagram of enrypted proxy firewall penetration target server Table 1 Existing ontent filtering tehnology and the orresponding penetration tehnology ontent filtering tehnology DNS request filtering Webpage ontent filtering IP address filtering penetration tehnology Transmitted DNS request paket through an enrypted hannel or overt hannel Transmitted Web traffi through an enrypted hannel or overt hannel Transmitted all traffi through an enrypted hannel or overt hannel Figure 2 the model s logi diagram Table 2 omparison of ommonly used tools for penetration Transmitted DNS request paket through an enrypted hannel Transmitted Web traffi through an enrypted hannel Transmitted all traffi through an enrypted hannel Ultra Surf supporte d supporte d supporte d Gaps Frigate Garden supportunsupporsupport ed ted ed supportsupporte ed d supportsupporte ed d support ed support ed 83

3 The breakthrough effet of network bloking software by different enryption methods is different. In view of the existing mainstream network enrypted proxy software, we presented the omparative test results of the network penetration method and apability, as shown in Table 2. As an be seen, not all of the tool will enrypt all of the ontent, for example, the Free Gate software does not enrypt the DNS request paket, and this approah provides the appropriate means of detetion. 3. DETECTION METHODS FOR NETWORK PENETRATING BEHAVIOR BASED ON COMMUNICATION FINGERPRINT 3.1 Working mehanism and proess The detetion model works on the network gateway, aiming to detet the use behavior of enrypted proxy software through the analysis of network data flow. The working mehanism and the proess are shown in Figure 2. In order to aurately identify different types of enrypted proxy software, here we introdue the onept of ommuniation fingerprints, whih ontains five attributes, suh as port features, IP features, protool enryption features, dynami flow harateristi and the paket payload harateristis. To take into aount the effiieny and auray, the detetion mehanism should be stratified. In this paper the detetion engine is divided into three levels, among the port, IP is a wide range of blind san layer, followed by the intention detetion layer omposed by protool enryption behavior and dynami flow behavior. On the basis of the two above detetion layers, exat mathing layer uses the paket s payload harateristis for ontenting detetion. Blind san layer, intention detetion layer and aurate mathing layer investigate step by step from three levels that is the ommuniation protool, ommuniation behavior and the ommuniation ontent. Generally speaking, with the detetion level layer depth the performane ost inreases. However, this hierarhial heuristi detetion arhiteture an not only ensure a very high detetion auray, versatility and adaptability[8], but also signifiantly redues the ollet quantity and analysis, at the same time make it possible for rapid detetion and aurate reognition under the omplex bakground noise. 3.2 Part of the key tehnologies Formal desription method of ommuniation fingerprints harateristis In order to determine what kind of network harateristis an be used as network fingerprint of speifi software [9], we defined the onept of network fingerprint model and gave the general formal desription. [Definition] Network fingerprint model: network fingerprint model an be abstrated as a 5- tuple array, expressed P I P O as FP =<,, C, O, F >. Among them, P I represents a set of input data pakages, O P represents the set of output or response pakages, = {,,..., } represents network harater C n set, O o o om = {,,..., } represents the deteting objets, suh as, O = {OS type,url, Payload}. The fingerprint detetion funtion F is defined as: P P P P P = = {( x, y) x, y } is a I O I O direted ordered pair, Z = ρ( P), then F is mappings of the power set of the Cartesian produt on the P and I P, that is, F : Z C. O Aordingly, we got the neessary and suffiient onditions whether network feature an be used as a fingerprint model, suh as: Testability: For the detetion of objet O, Z, there existed C,whih make F( ) = C ; Uniqueness: For the detetion of objet O, to arbitrary Z 1 Z, Z2 Z, and,then we got F( ) F( ), and vie versa. Stability: For the detetion of objet O, to arbitrary Z1 Z, Z2 Z, and, there existed C,whih make F( ) = ;or there existed C 2 1 and 2, whih make F( ) = ourred simultaneously. ( ) =, 1 F C C 2 F( ) C, = and Separability: For any two different network ommuniation software i and j, exerted the same detetion funtion on the same objet, that is, FP =<,,,, i P I O F i P Oi C > i, =<,,,, j Ij O F >,i j,then Oj j i j FP P P C 1 84

4 In order to apture the ommuniation behaviors of enrypted proxy software, we an use a kind of reverse diretion analysis method, or blak box testing method to analysis ommuniation pakets. Figure 3 gives the operation and ommuniation mehanism of the Free Gate software when it runs on a omputer the first time. First, the Free Gate started, and then tested environment during the startup, then the speifi data were generated, through a variety of queries the Free Gate obtained proxy server information, after aessing to information of proxy server it began to establish the proess of enryption ommuniation, if it an suessfully start its ommuniation. In order to ensure that data will not interepted by third parties, the proxy server and lient devies need to ommuniate seurely, whih is divided into two parts involved by seret key establishment and seure ommuniations. Thus, it an be summed up that the network ativity of network penetrating software is divided into three stages [10, 11]: Deteting. Aess to domesti and foreign wellknown sites is used to detet whether the internet an be aess. Aess. Aess to full-time DNS server provides updates information support. Enrypting. Aess to the enrypted proxy server usually uses SSL enryption. Figure3. Communiation sequene diagram of enrypted proxy software Through the above analysis we an find that the ommuniation pakets of enrypted proxy software have the two ategories of features, whih are payload harateristi ode and dynami flow anomalies. Therefore, we used both deep paket inspetion (DPI) and dynami flow inspetion (DFI). DPI not only analyed the 5-tuple of IP header, but also added the appliation layer payload segment analysis, thus it an not only aurately reognie enryption agent ontent, but also deal with the esape behaviors suh as port-reuse, random port or even the enrypted transmission. DFI identifies enryption agent traffi via average flow rate, flow duration, number of bytes, paket length and other harateristi information. Through a large number of data paket analysis experiment, we established the flow harateristi model. By apturing the series of flow behavior and omparing with the flow model, thus the use behavior of the enrypted proxy software an be deteted. As an example, the key features of Free Gate s ommuniation stream were extrated as follows: DNS query paket length is generally 558. Aess to most of the IP does not belong to the mainland (among them, China Taiwan and the United States aount for a larger proportion). DNS requests use the same port for 2-3 rounds of queries. DNS is divided into 5 setions. Eah round of query interval may be equal; eah wheel is equal to the number of queries. HTTP and DNS use serial ports, and DNS request ports greater than The DNS name servers and proxy servers end in16.mjuyh.om, suh as: d8ef0d40b f.a 0ff830ba9a8dd e47271d55a mj uyh.om. Use SSL to enrypt the ommuniation Identifying SSL-enrypted data Almost all enrypted proxy software adopted SSL to enrypt the ontents of appliation layer, as shown in Table 3. Therefore, the use of SSL 85

5 protool an be used as an assist feature on the ommuniation behaviors of suh software. SSL protool stak was shown in Figure 4[12]. Beause the sequene enryption in Reord Protool didn t have any filling mehanism, the protool iphertext length exposed the plaintext length, so that flow analysis an be done. On the other hand, the handshake messages transmitted in plaintext before the "Finished" message in the handshake protool layer, thus it an be used for payload harateristi ode analysis [13, 14]. The method is to first filter out the session flow by 443 ports, and then examines the session payload ontents to identify whether there exists some orresponding feature strings deision trees algorithm The deteting proess of enrypted proxy software based on the network data pakage is in fat a lassifiation problem to distinguish the enrypted proxy ativities from legitimate ommuniations. As an important data mining Tehnology, lassifiation is designed aording to the harateristis of the data set to onstrut the lassifiation funtion or model, by whih the unknown samples an be mapped in a ertain to a given ategory. Strutural model was generally divided into two stages, that is, training and testing, and aordingly the model data sets were randomly divided into training set and test data sets. In the training phase, the training data set was used to onstrut the lassifiation model by analying the data desribed by the attributes. When in the testing phase, the test data set was used to evaluate the auray of the lassifiation model, if that model auray is aeptable, then it an be used to lassify for other data[15]. In this paper, the deision tree model to detet enrypted proxy software used ommuniation fingerprints as input vetor, as shown in Figure 5. Considering that the tree struture was too omplex and will produe over-fitting, to avoid this, we should onsider the partial ordering relation existing in the importane of properties used to identify enryption agent software, whih is we must take the important as prinipal omponent and the less important for lipping. In addition, in order to improve the effiieny of algorithm model, we adopted the Hash table instead of a database to store ommuniation fingerprints. The node element of Hash table indiates the ommuniation behaviors of one host, ommuniation behavior data types and Hash types are as follows: Typedef strut // Defining the node in Hash table { Int USER_ID; // Using IP-MAC as primary key Char ComFP; // attribute name of eah ommuniation fingerprint Int TreeNet; // the level of behavior tree whih the ommuniation fingerprint lying on ElemType* next }ElemType Typedef strut //defying Hash table using HashTab { ElemType* next; Int ount; // key value Int typeindex; // key value } Hash Tab Table 3 test results of ommon penetrating tool for appliation-layer enryption Ultra Free Gaps Surf Gate Garden HTTP ipherte iphertex iphert ipherte HTTPS ipherte iphertex iphert ipherte Mail ipherte iphertex iphert ipherte FTP ipherte iphertex iphert ipherte Google Talk ipherte iphertex iphert plaintex xt t ext t Windows Live ipherte iphertex iphert plaintex Messenger xt t ext t Figure 4 SSL protool stak 86

6 4. EXPERIMENT AND RESULTS ANALYSIS Figure 5 Communiation behavior trees and filtering algorithm In the detetion experiments, we build the network ommuniation environment needed by Ultra Surf browser, deployed network paket apture software on the network export, and then loaded the pakets into our filtering algorithm model. In order to simulate the real traffi environment, we used the ampus network ommuniation flow as bakground noise, by importing experimental data aptured by Campus Network Center on that day; our model suessfully loated a plurality of suspiious pakets file. One of our tests shows that our model orretly identified the Ultra Surf browser and suessfully assoiated its ommuniation behavior proess: host used Ultra Surf browser, after starting, the Ultra Surf browser opened the 2224 port, and then launhed frequent periodi onnetion to its enrypted proxy server, after a suessful onnetion it used HTTPS enryption protool to ommuniate with a network host whih IP is , the host s loation was Taiwan. 5. CONCLUSION AND FUTURE WORK In this paper, we have presented the heuristi detetion with multi-feature, introdued the onept of ommuniation fingerprint to extend the range of ommuniation features, and developed deision tree methods to distinguish the enrypted proxy ativities from normal traffi. Being expanded slightly, the method an be used for detetion and 87 reognition of the other network ommuniation software. Future work will inlude: The expansion of training sets, test sets and the experiments for various kernels whih an be use for performane improvement and some of its onstraint parameters; Aording to the different harateristis of the ommuniation software, the unified, standardied, and formalied desription of ommuniation feature will be studied; Communiation fingerprint automated extration tehnology is a key researh diretion of the next step. 6. ACKNOWLEDGMENT This work was support by the Projet of Applied Basi Researh of Sihuan Provine(No.07JY ), the Projet of Department of Eduation of Sihuan Provine(No.12ZB105). REFERENCES [1] L.Yan, H.Z. Li and Z.G.Tang, Mingquan ZHONG. Tehniques of Trojans penetrating personal firewall, Netinfo Seurity, Vol.9, No.20, 2010,pp: [2] L. Peng, Researh on Network penetration tehnique, Beijing University of Posts and Teleommuniations, [3] D.X. Qu, X.T. Tang, L.C. Xu and L.Shi, Overview of Researh on Network Information

7 Filting System, Journal of Shandong Normal University, Natural Siene, Vol.22, No.2, 2006, pp [4] Z. Zhou, X.M. Han and B. Wen, Analysis of Enrypted Proxy Servers Tehniques. Journal of Information Engineering University, Vol.7, No.4, 2006, pp: [5] D.F. Liu and P.C Tan, Effiient Approah for Searhing Data Pakage of Enrypted Proxy, Command Information System and Tehnology, Vol.1, No.4, 2010, pp: [6] C.L Wang. Researh on the penetrate tehnology of Boundary network safety protetion devie. Network & Computer Seurity, Vol.2, 2007, pp: [7] J. Smart, K. Tedeshi and D. Meakins, Peter Hannay & Christopher Bolan., Subverting National Internet Censorship-An Investigation into existing Tools and Tehniques, forensis/smart%20et%20al%20bypassing%20 Internet%20Censorship.pdf. [8] L. Martignoni, E. Stinson, M. Fredrikson, S. Jha and J.C. Mithell, A Layered Arhiteture for Deteting Maliious Behaviors, RAID 2008 pp: [9] Z.G. Tang, H.Z. Li, M.Q. Zhong, J. Zhang. Study of Remote Computer network Fingerprint model. Computer Engineering and Design, Vol.32, No.8, 2011, pp: [10] Z. Zhou, Effiient Approah for Searhing Data Pakage of Enrypted Proxy. Computer Engineering, Vol.33, No.21, 2007, pp: [11] H.T Gao, Researh on investigation and evidene olletion of network penetrating software. Polie Tehnology, Vol.11, No.6, 2010, pp: [12] L. Zhang. Researh and appliation of SSLbased VPN enrypted tunnel. Information Tehnology, Vol. 8, 2010, pp : [13] Y. Luo and Z. Huang, Priniple and Prevention of SSL Attak In Gateway Mode. Information Seurity and Communiations Privay, Vol.4, 2011, pp: [14] S.M. Yang and S.D. He, The SSL protool onnetion proess and safety performane analysis, Software Guide, Vol.10, No.3, 2011, pp: [15] N.N. Xie, Y.X Liu. Improvement of attribute seletion riterion of deision trees. Computer Engineering and Appliations, Vol.46, No.34, 2010, pp: