计算机科学 ›› 2026, Vol. 53 ›› Issue (10): 440-446.doi: 10.11896/jsjkx.260100048
冯学伟1, 唐启勋2,3, 李敏2, 杨宇翔1, 李兆曦1, 詹兴祥2, 何艺4, 陈驰5, 李琦2,6, 徐恪1,2
FENG Xuewei1, TANG Qixun2,3, LI Min2, YANG Yuxiang1, LI Zhaoxi1, ZHAN Xingxiang2, HE Yi4, CHEN Chi5, LI Qi2,6, XU Ke1,2
摘要： 近年来,随着互联网规模扩张和应用生态演化,网络安全面临前所未有的挑战。越来越多的新型攻击利用TCP/IP协议栈端到端交互中的语义安全问题,突破协议边界,直接危及端侧主机,导致服务中断、会话劫持和数据投毒等问题,传统基于特征匹配或离线分类检测的防御手段已难以应对。针对这些问题,提出了PacketScope——首个由大语言模型(LLM)驱动eBPF的端侧协议栈安全防御系统。PacketScope基于eBPF实现对分组在协议栈处理路径中的动态观测,构建细粒度协议交互图,定位风险与性能瓶颈,并通过XDP将实时流量导入LLM进行协议交互长上下文推理与深度分析,判别socket行为、识别攻击,并最终生成eBPF规则实现栈内实时防御。在Linux 6.8内核上的实现与开源验证表明,PacketScope可完整重建分组交互全景图,并结合TrafficLLM,DeepSeek等模型识别和阻断DoS,TCP劫持等攻击,额外开销低于1.9%。
中图分类号:
| [1] FENG X X,YANG Y X,LI Q,et al.ReDAN:An Empirical Study on Remote DoS Attacks against NAT Networks [C]//Network and Distributed System Security Symposium.The Internet Society,2025. [2] FENG X X,LI Q,SUN K,et al.Off-Path Network Traffic Manipulation via Revitalized ICMP Redirect Attacks [C]//USENIX Security Symposium.USENIX Association,2022. [3] CAO Y,QIAN Z Y,WANG Z J,et al.Off-Path TCP Exploits:Global Rate Limit Considered Dangerous [C]//USENIX Security Symposium.USENIX Association,2016. [4] FENG X W,LI Q,SUN K,et al.Exploiting Cross-Layer Vulnerabilities:Off-Path Attacks on the TCP/IP Protocol Suite [J].Communications of the ACM.2025,68(3):48-59. [5] Annual Cost of Cyber Crime Worldwide from 2016 to 2030[EB/OL].https://www.statista.com/forecasts/1280009/cost-cybercrime-worldwide/?srsltid=AfmBOoo6TyTve7DZkXd4hX0geK7Pqw26hIPh2852lcanT1NyFxw8v1bP. [6] CUI T Y,LIN X J,LI S J,et al.TrafficLLM:Enhancing Large Language Models for Network Traffic Analysis with Generic Traffic Representation [J].Communications of the ACM,2025,68(3):48-59. [7] MAN K Y,ZHOU X A,QIAN Z Y,et al.DNS Cache Poisoning Attack:Resurrections with Side Channels [C]//ACM Confe-rence on Computer and Communications Security.ACM,2021. [8] MAN K Y,QIAN Z Y,WANG Z J,et al.DNS Cache Poisoning Attack Reloaded:Revolutions with Side Channels [C]//ACM Conference on Computer and Communications Security.ACM,2020. [9] YANG Y X,FENG X W,LI Q,et al.Exploiting Sequence Number Leakage:TCP Hijacking in NAT-Enabled Wi-Fi Networks [C]//Network and Distributed System Security Symposium.The Internet Society,2024. [10] KLEIN A.Cross Layer Attacks and How to Use Them(forDNS Cache Poisoning,Device Tracking and More) [C]//IEEE Symposiumon Security and Privacy(S&P).IEEE,2021:1179-1196. [11] FENG X W,LI Z X,LI Q,et al.Off-Path TCP Exploits:PMTUD Breaks TCP Connection Isolation in IP Address Sharing Scenarios [C]//ACM SIGSAC Conference on Computer and Communications Security.ACM,2025. [12] XU K,FU S T,LI Q,et al.The Research Progress on Intrinsic Internet Security Architecture[J].Chinese Journal of Compu-ters,2021,44(11):2149-2172. [13] YU B,SU J S,YANG Q,et al.Survey on Vulnerability Mining Techniques of Network Protocol Software[J].Journal of Software,2024,35(2):872-898 |
|
||
首页