CN104243228A - Method for detecting HTTP tunnel data based on conversation and HTTP protocol standard - Google Patents

The invention belongs to the technical field of computer networks, and provides a method for detecting HTTP tunnel data based on a conversation and the HTTP protocol standard. A system captures a data packet of an HTTP port and establishes a conversation linked list according to the IP address and the port. When the data packet arrives at a detection system, firstly, the system examines and maintains the conversation linked list, a record is added if not record exists, and the record is deleted from the conversation linked list if the RST data packet or the FIN data packet exists; secondly, the system examines the content of the data packet and judges whether the conversation connection meets the standard HTTP protocol, such as a client-side command GET, a client-side command POST, a server-side response HTTP/1.0 and a server-side response HTTP/1.1, or not, if the conversation connection meets the standard HTTP protocol, the conversation is marked as HTTP protocol data, and if the conversation connection does not meet the standard HTTP protocol, the conversation is marked as HTTP tunnel data. By means of the method, the HTTP tunnel data can be recognized, differential service can be conducted on the HTTP tunnel data, or data which are not the HTTP protocol data can be prevented from penetrating through the HTTP port.

The method of dialogue-based and http protocol standard detection HTTP tunneling data

Technical field

The invention belongs to technical field of the computer network, is a kind of method distinguishing standard HTTP data and HTTP tunneling data.

Background technology

Along with the development of Internet technology, how to control Intranet user access the Internet and become the emphasis of network management.Traditional network management distinguishes various network service with port, is realized the control of extranet access by open or closedown certain port.WEB browses to be needed to open to user's use as the most basic Internet service usually, and its http protocol that uses, default port is TCP80.In view of http port is generally open, all kinds of software employs HTTP tunneling technique one after another and outside connects.Http data and HTTP tunneling data all use identical port, therefore can not simply by close port control HTTP tunneling data, otherwise user cannot browsing page.Traditional port controlling method cannot tackle HTTP penetration tunnel technology, and the safety of internal network in unwarranted extranet access serious threat.

Summary of the invention

The object of the invention is to propose a kind of method distinguishing standard HTTP data and HTTP tunneling data, use the present invention can identify HTTP tunneling data and differentiated services is carried out to it, or stoping non-http data to penetrate http port.

Conveniently describe, first the Essential Terms that the present invention relates to and mark be described below:

1.SrcIP, SrcPort, DstIP, DstPort: represent source IP, source port, Target IP, target port respectively.

2. session (Session): all information datas in client and server connection procedure.

3. session connection table (Session Table): for preserving the tables of data of multiple session, usually can adopt Hash table.

HTTP tunneling data Cleaning Principle:

The http protocol of standard defers to RFC2616 (Hypertext Transfer Protocol--HTTP/1.1) and RFC1945 (Hypertext Transfer Protocol--HTTP/1.0) standard.

Description according to RFC document:

1, when HTTP client initiates request to HTTP service end, order will be sent request: as " GET ", " HEAD ", " POST ", " PUT ", " DELETE ", " CONNECT " etc.Wherein " GET ", " HEAD ", " POST " are modal HTTP order, other HTTP orders then less use or for Connection Proxy server.Http protocol standard specifies, request command should be positioned at the data first trip start-up portion that client issues service end.

Such as:

GET/index.html?HTTP/1.1

Host：www.example.com

Connection：keep-alive

Accept：text/html

......

2, after HTTP service end receives the request command of HTTP client, response message will be returned: as " HTTP/1.1200OK ", " HTTP/1.0404 Not Found " etc.Http protocol standard specifies, response message should be positioned at the data first trip start-up portion that service end issues client.

Such as:

HTTP/1.1?200OK

Server：Apache

Content-Type：text/html；charset＝utf-8

Connection：keep-alive

......

HTTP tunneling data then adopts proprietary protocol, and it does not defer to http protocol standard.The data start-up portion that client issues service end is not the request command such as " GET ", " HEAD ", " POST "; Service end returns to the data start-up portion of client neither the condition responsive information such as " HTTP/1.1 200OK ", " HTTP/1.0404 Not Found ".

According to these difference, the request command that we can be started by inspection session connection client most and the response message that service end starts most, judge that this session is http protocol session or HTTP tunnel session.

Accompanying drawing explanation

Fig. 1 is present system network design mode figure

Fig. 2 is that process chart safeguarded by present system session connection table

Fig. 3 is that present system is to client data bag overhaul flow chart

Fig. 4 is that present system is to service end packet overhaul flow chart

Embodiment

Below in conjunction with accompanying drawing, the present invention is further described in detail.

Grid deployment way:

See Fig. 1, present system is deployed in the egress gateways place of local area network (LAN) connecting Internet usually, catches the packet of designated port from network.This port is generally TCP80, also can specify or increase other ports if desired.

The maintenance of session connection table:

See Fig. 2, system captures designated port packet from network, from packet, extract the information such as SrcIP, DstIP, SrcPort, DstPort, contrasts with project existing in session connection table.If there is not this conversation recording in session connection table, then this session information newly-increased is in session connection table.If there is this session connection record, then more new session last activity time.When receiving conversation end packet (TCPRST, TCP FIN) or session timeout then deletes this session information from session connection table.

Session protocol detection method:

The standard detected is to judge whether session data meets http protocol, can judge that this session is http protocol session, otherwise be HTTP tunnel session as long as meet.Here select for the efficient detection mode of one: by detecting front 4 bytes of session data, determine whether http protocol.But and do not mean that the present invention can only in this, as unique detection method.

1, client data detects

See Fig. 3, system acquisition issues the session data of service end to client, and first package the operations such as sequence.Then extract front 4 bytes of client data content, and be converted to upper case character by unified for these 4 bytes.Mate with the request command such as " GET ", " HEAD ", " POST " again.(" GET " order only has 3 bytes, but after the HTTP request order of http protocol standard regulation followed by space as separator.Therefore add a space character with " GET " order to mate.In like manner " CONNECT " order then intercepts front 4 bytes, mates with " CONN ".) if the match is successful, marking this session is http protocol session, otherwise is labeled as HTTP tunnel session.

2, service end Data Detection

See Fig. 4, system acquisition issues the session data of client to service end, and first package the operations such as sequence.Then extract front 4 bytes of service end data content, and be converted to upper case character by unified for these 4 bytes.Mate with response messages such as " HTTP " again.If the match is successful, marking this session is http protocol session, otherwise is labeled as HTTP tunnel session.

In a session connection, client data and service end data are two-way.Therefore can select only to detect client data, also can select only to detect service end data, can also select to detect client data and service end data simultaneously.

Above embodiment is only unrestricted for illustration of the present invention.Those of ordinary skill in the art should be appreciated that and revise distortion to the present invention or equivalent to replace, and do not depart from scope of the present invention, and it all should be encompassed in the middle of claim of the present invention.