- Expansion of possibilities and increase of efficiency of network reconnaissance on opening of client-server information systems actualize questions of maintenance of their stability to influences of destabilizing factors. Known methods of protection against network reconnaissance, based on the implementation of the principles of spatial security, as well as the formalization and implementation of many prohibitive regulations based on the detection and response to the fact of network reconnaissance or computer attacks, are not able to effectively withstand the modern means of network reconnaissance. Implementation of such protection methods forces the attacker to continue influencing the client-server information systems and (or) change the strategy of impact. The article presents a model that allows to study the processes of client-server information system functioning in the conditions of network reconnaissance at various strategies of interacting parties, as well as management of resource opportunities of network reconnaissance facilities when establishing and maintaining network connections. Interaction of conflicting parties is presented in the form of Markovian process with discrete states and continuous time. Elements of novelty of the developed model is the application of the mathematical apparatus of the theory of Markovian processes and the solution of Kolmogorov's equations for the study and solution of the problem of dynamic management of resource opportunities of the clientserver information system due to the management of parameters of network connections. The practical importance of the developed model consists in finding the probabilistic and temporal characteristics describing the state of the process of functioning of the client-server information system at various strategies of establishment and maintenance of parameters of connections by the interacting parties.
Currently, a large number of computer attacks are of an
intelligence nature used by the attacker with the help of
network reconnaissance tools in order to obtain information
about the topology and typology of the information system that
is the object of the computer attack, as well as the information
system security features. Possibilities of network
reconnaissance are conditioned by openness of architecture of
information systems and protocols of information exchange
(TCP/IP family), providing interaction through the
organization of interfaces of network reconnaissance with
elements of information system. Interfaces allow to carry out
interaction of consistently connected devices and programs of
the received cumulative system realizing the channel of
information leakage [
The key phases of interaction are software suppression
(denial of service), event control (monitoring) and management
(control interception). The first phase differs from the third in
that it may be declarative in nature, and network
reconnaissance may lose the ability to implement dialogue. If
the information system is isolated, the means of ensuring the
security of information interaction are implemented through
computer attacks and undeclared capabilities, ensuring the
«delivery» of technical means of network reconnaissance in the
infrastructure of the information system (providing contact of
technical means of network reconnaissance with the object of
protection). Dialogue (software, protocol) interaction is carried
out locally from the data link layer of the reference OSI model,
and remotely – from the network layer [
In turn, information security violators are also actively
developing and improving tools to reduce the effectiveness of
network traps, implementing the following methods of
compromising: detecting the unique identifiers (unmasking
features) of network traps and detailed analysis of network
traffic coming from network traps. Such an unmasking feature
of the network «trap» is the use of the value of the
TCPpackages «window size» service field, which is set to ten bytes
by default [
The purpose of dynamic configuration of information system network connection parameters in the conditions of network reconnaissance is to promptly serve the maximum number of requests of authorized clients with simultaneous reduction of the quality of service of network reconnaissance requests. Since there are no physical level disturbances, it is advisable to determine the disturbing factors of the environment as a set of software interferences and software suppression (computer attacks such as «denial of service», socalled DOS- and DDOS- attacks).
II.
OBJECT OF STUDY ANALYSIS
In order to transfer information between remote information systems, as well as between clients and servers in the information system with client-server architecture, a logical connection is established via communication protocols. The increase in the intensity of incoming information flows from one IP-address, multiple IP-addresses may lead to the implementation of an attack such as «Denial of Service» (DoS), or a distributed attack such as «Distributed Denial of Service» (DDoS), respectively.
Information flow management provides the TCP Internet protocol, it allows you to maintain the reliability of transmission over the TCP protocol by adjusting the speed of information flows between the sender and the recipient of TCP-packages during a particular session. Information flows are controlled by limiting the number of data segments transmitted at one time, as well as requesting confirmation of receipt before sending the next segments.
The connection is initiated by the sender of the message packets. If it is necessary to exchange data with the recipient of message packets, the client application refers to the underlying TCP protocol, which in response to this sends a segmentrequest to establish a connection to the TCP protocol, working on the side of the sender of the message packets, among other things, the request contains the SYN flag set in «1». After receiving the request, the server allocates certain system resources, setting the initial value of the WN field «window size» (for example, 25 bytes) for the formation of the TCP header of the response packet of messages, announcing to the sender of the packets of messages about its readiness to receive a certain amount of data, as well as other variables of connection. After all the necessary actions are performed on the server side, the resources are defined, the TCP module sends the client a segment with the flags ACK and SYN with the installed WN to the sender. In response, the client sends a segment with the ACK flag and switches to the state of the established logical connection.
The duration of the delay may increase and then the server may suspend the information exchange with the client in those periods of time when the information system or server resources (the recipient of TCP-packages of messages) are overloaded. For this purpose the server establishes value of the TCP-buffer by an establishment of a field «window size» in TCP-header of a package of messages equal to zero WU = 0, initiating thereby the mechanism of deduction in the bilateral order of connection with the sender of packages of messages, and directs to it corresponding packages of messages. Initiative reduction of speed of data transmission at each session helps to reduce the conflict of resources of the sender and the recipient of TCP-packages of messages in case of initialization of several sessions of communication. This reduces data loss and the number of redirection of data.
After receiving a message packet with WU = 0, according to the TCP protocol specification, the sender of the message packets will periodically send test single-byte segments, asking the recipient to repeat the information about the size of the window and the expected next byte (the so-called test segment «zero-window probe») to determine when he will be able to resume sending data. By implementing a two-way hold mechanism for the connection with the sender of the message packets, the server may not enlarge the window, leaving it at zero, thereby keeping the sender of the message packets blocked in the long connection for a while until the timeout expires.
If the sender of the message packets wants to break the connection (send a packet of messages with the FIN flag in the TCP header) or send urgent data (send a packet of messages with the URG flag in the TCP header), the recipient of the message packets can ignore these incoming packets of messages by blocking them. The server, while ignoring these packets, forces the client operating system to maintain connection resources until FIN-WAIT-1 expires, waiting for the TCP segment from the server to confirm that it is ready to close the connection. The server (the packet recipient) does not maintain the connection state on its end and does not consume its computing resources, which allows it to fully implement the functions of processing of incoming messages packets from clients with higher priority.
The server sends ACK messages to the client to confirm that the client has received a segment of data (or a set of segments). In the process of information exchange via communication channels it is possible to disrupt the order of segment delivery and loss of segments, which makes it necessary to retransmit them from client to server. In particular, if there is interference in the communication channel, it is possible to send three duplicates of ACK confirmation to each of the received fragments of the TCP-package of messages, which is the use of the saturation control algorithm - the fast repetition algorithm (Fast Retransmit) for the TCP protocol.
Thus, the server strategy is to optimize the distribution of its
resources to ensure the timely processing of customer requests,
taking into account their priorities, which can be achieved by
dynamic management of connection parameters [
III.
CLIENT-SERVER INFORMATION SYSTEM FUNCTIONING
MODEL
Let's assume that there is a node of the information system a server that ensures the functioning of the client-server system, including in the part of the system of control (evaluation) of the idle time value. The simulated system S changes its state over time (passes from one state to another). Required to study the state of the client-server information system S1, S2, … can be listed as follows:
S1 – The client is idle, does not receive and does not transmit message packets;
S2 – Initialization of the connection by the client; S3 – Estimation of the customer downtime;
S4 – Setting (changing) the data flow rate between the client and the server by setting (changing) the «window size» parameter W;
S5 – Establishing (confirming) the connection by the server and receiving the «window size» parameter W by the client;
S6 – Transmission and reception of data flows between client and server;
S7 – Confirmation by the server of receiving data stream parts (acknowledgement).
Moments of possible transitions of the client-server information system from the state to the state are uncertain, random and occur under the action of the event flows characterized by their intensity λ, presented in Table 1, which are an important characteristic of the event flows and characterize the average number of events per unit of time.
The graph of client-server information system functioning states is shown in Fig. 1.
S2 λ12 λ41 S1
S4 λ45
The estimation of efficiency of functioning processes of information system is connected with necessity of modeling of process in real time that causes expediency of use of the mathematical apparatus of Markovian processes which necessary conditions - streams of events are the elementary (possess properties of stationarity, ordinariness and have no consequences). So, the process of client-server information Requests for assessment of idle time after the client initializes the connection Request for setting (changing) the data flow rate between the client and the server by setting (changing) the «window size» W parameter Requests for assessment of idle time after setting (changing) the «window size» W parameter Request for the server to establish (confirm) a connection and receive the «window size» W parameter by the client Request for transmission and reception of data flows between the client and the server after confirmation of the connection establishment server (WN and SYN ACK transmission) Requests for assessment of idle time in the process of data transmission and reception between the client and the server Requests for confirmation by the server of the data stream parts reception (acknowledgement) Requests for evaluation of idle time after server confirmation of data stream parts reception (acknowledgement) Requests for the client to send the next part of the data stream after the confirmation of the reception of a part of the stream Requests for maximization of the client idle time (0-speed data flow parameters) by setting (changing) the «window size» parameter W = 0 Requests for estimation of the value of the client idle time a. λ – Intensity of event flows
Let's consider the scenario of transition of the simulated system from the Si state to the Sj state under the influence of event flows with intensities of λij.
When a client-server information system is functioning, objective limitations arise on the performance of both the information system as a whole and its elements. The situation becomes worse when clients with different priorities appear. Therefore they use the dispatching of clients' requests to the server in such information systems. Processing of requests from users with lower priority is suspended without breaking the connection with them if necessary. It is rational, as the repeated establishment of connection causes repetition of the technological operations connected with it that negatively influences on information system productivity.
Let S1 be the initial state of the simulated client-server information system, in which it does not receive and transmit data flows, i.e. the state of rest, which is characterized for the client by a high value of the idle time, which is evaluated in the state S3 (on request λ13). It is also reasonable to put the clients to this state of S1, and the requests received from them are able to overload the server so that they do not have the resource for switching to the state of S2 by initialization of λ12 requests for connection to the server. The clients can initialize alternative requests of λ12 until the system resource is exhausted, which will occur if the previous data streams are not closed. If there is still such a resource, the S system switches to the S2 state and initializes the connection to the server for transmission of message packets with the SYN flag installed. A similar event
Initial conditions are set to solve Kolmogorov's differential equations. The vector of probabilities of initial states of the Markov chain taking into account absence of influences on the client-server information system at the initial moment of time looks like: occurs in the investigated S system when new (alternative) authorized clients or new requests from already connected clients appear in it, but via another protocol (organization of a new socket). In this case, λ23 requests to estimate the value of S3 idle time after initialization of the connection by the client appear in the simulated system.
After evaluation of the value of the idle time indicator in the system S, λ34 requests to set (change) the data flow rate between the client and server S4 by setting (change) the «window size» parameter W. The value of this parameter is selected in accordance with the value of the idle time indicator of the information system under study: if the connection is initialized by clients with low or usual number of requests, and the server performance has a limited resource, the value of the «window size» parameter W is set to some non-zero value of WN, for example, WN = 20 bytes. Otherwise, if the connection is initialized by clients with a large number of requests that can overload the server, there is a possibility to set the value of the «window size» parameter W to zero, WU = 0 bytes. As a result, λ41 requests for maximizing the idle time value arise in the investigated S system. λ43 requests for evaluation of the idle time value after establishing (changing) the «window size» parameter W allow to dynamically change (regulate) the data flow rate from clients to the server. If a non-zero value of WN is set, then λ45 requests to establish (confirm) a connection by SYN ACK server and to receive the «window size» parameter W by the clients arise in the investigated system S, after which the system switches to the state S5. This state causes λ56 requests to transmit and receive data flows between the clients and the server if the clients (server) have data to be transmitted. As a result, the S system under study switches to the state of S6 of data transmission and reception between clients and the server, which leads to λ63 requests for assessment of the idle time value of data transmission and reception between clients and the server. In the process of data streams transmission and reception the clients and the server exchange receipts (confirmations) – the state of S7 for λ37 requests. The acknowledgement procedure also affects the value of the idle time indicator, which is reflected in the column for λ73 requests for its evaluation.
After receiving the next λ76 receipt from the server, the clients transmit the next part of the data stream to the server. If any parts of the data stream are destroyed in the process of transmission or come from the clients to the server in the wrong order as a result of intentional and/or unintentional interference with the communication channel and the server, the data transmission speed in the client-server information system decreases. In this case, it is not advisable to talk about a S system or clients idle, so there is no corresponding link between the states of S7 and S1 on the status bar.
A mathematical model of the client-server information system functioning - differential equations with unknown functions pi(t) - is built on the basis of the marked graph of client-server information system states: (3) (4) (5) which corresponds to a high downtime value.
The system of linear differential equations (3) with constant coefficients (homogeneous markov process) is solved by setting numerical values of intensities λ, presented in Table 2, and passing to continuous time t . For any moment t the sum of all probabilities of states is equal to one: i1 n pi t 1
The nature of the selected intensity values is determined in accordance with the strategies of the clients and the server - the parties to the resource conflict.
The client-server information system model takes into account the impact on the server of authorized clients with different request priorities and the number of requests.
The use of the model involves the search for strategies for interaction between the server and the information system clients, and will allow to proceed to the probabilistic assessment of the downtime of the information system and the means of network reconnaissance. Taking into account in the Markov model the time of stay of the information system in each of the states depending on the strategies of the interacting parties allows to study the dynamics of the client-server information system functioning.
The initial data for modeling are the following: the system of linear differential equations (3); the vector of probabilities of initial states (4); the values of the event flows intensity presented in Table 1; the standardization condition (5).
The classical method of the fourth order (the Runge-Kutta method with a fixed integration step which is given to the vector representation) is applied as a method of solving the system of linear differential equations, where each element corresponds to the right side of a certain differential equation in the system.
The use of the known order of solution of the system of linear differential equations by the Runge-Kutta method allows to receive the numerical table of approximate values pi of the sought solutions p(t) on some interval t [t0 , t1] .
Thus, the probabilistic and temporal characteristics describing the states of the client-server information system functioning process are obtained, which, in their turn, form the basis for the research of this process at various strategies of interacting parties, as shown in Table 3, which allows to evaluate the state of the client-server information system.
Let's evaluate the model's stability to the variations of the initial data, setting the boundary values in the strategies of the interacting parties, while considering the following variants of strategies:
C1 is a strategy without confirmation and with a queue, in this case, the connection of clients to the server is carried out via the UDP protocol, where reliable data transfer and confirmation of their receipt, in case of need, must be implemented by the user application, the server receives a significant number of requests for connection from clients and builds them in the queue and then processes them consistently;
C2 is a strategy without confirmation and without queue, in this case the connection of clients to the server is carried out via the UDP protocol, where reliable data transfer and confirmation of their receipt, in case of need, must be implemented by the user application, the server receives connection requests from clients and manages to process them without delay (without the need to create a queue from the requests) or rejects them;
C3 is a strategy with the confirmation and with the queue, in this case the connection of clients to the server is carried out via the TCP protocol, where the server receives a significant number of connection requests from clients, builds them in the queue and then sequentially processes them;
C4 is a strategy with confirmation and without queue, in this case clients with the server is carried out through the TCP protocol, where the server receives connection requests from clients and manages to process them without delay (without the need to create a queue from the requests) or rejects them.
Values of event flows intensity are set as constant according to the chosen strategy of client-server interaction.
The graphs of the probabilities of the client-server information system functioning process states depending on the time p1(t), p2(t), …, p7(t) for the values of event intensities corresponding to the strategy С1, according to Table 3, are presented in Fig. 2.
At the time interval [0; 0,09] the information system is in the transient mode of functioning, where a spike in the probability values of the state of p2(t) and p3(t) is observed, that corresponds to the finding of the information system in the state of initialization of the connection by clients and evaluation of the value of the clients' idle time. p5(t) 0 p6(t) 0 p7(t) 0 … …
… .0.9 t) P1 ( ,pi P2 ttae P3 s a P4 n ig P5 n ieb P6 fo P7 y t i l i b a b o r e . 0 p h T 0.9 0.81 0.72 0.63 0.54 0.45 0.36 0.27 0.18 0.09 pi(t) 0 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09 0.1 .0 T.itme t.0,.s1ec Fig. 2. Results of calculating the dependence of probabilities of states on time for the values of event intensities corresponding to the strategy C1 In the case of t , a stationary mode is established in the information system when it randomly changes its states and its probabilities p1(t), p2(t), …, p7(t) no longer depend on time and are equal to the final (limiting) probabilities.
The final probabilities p1 = 0,513, p2 = 0,051, p3 = 0,348, p4 = 0,053, p5 = 0,023, p6 = 9,069·10-3, p7 = 2,547·10-3 show how long the information system stays in different states in average.
In order to study the process of functioning and protection of the information system at the listed strategies of functioning of the client-server information system, and the corresponding values of the intensity of events, the calculation of probabilistic and temporal characteristics is made according to the above example.
We obtain a numerical table of approximate pi values on
the interval t [
Approximate pi(t) values on the interval t [
Approximate pi(t) values for the values of intensity of the event flows of the strategy С4 are presented in numerical Table 6.
The developed model for the functioning of the clientserver information system takes into account the influence and the nature of the influence of the event flows from customers with low and high priority services, as well as the normal and large number of requests from clients to a server that can overload it. The process of protecting the server from overload in accordance with this model is to minimize the likelihood (and average time) of downtime for clients with a high priority of service or a large number of requests, and, therefore, minimize the likelihood of a server overload. Protection of the information system from event flows from clients with a high priority of service or a large number of requests involves the search for strategies for the functioning of the client-server information system depending on the changing options for interaction between the parties due to limited server resources in time. The model makes it possible to identify the dependences of the functioning of the client-server information system on the impact flows, evaluate the effectiveness of the client service, select algorithms for protecting the server from overload, and optimally use the server resources. The increase in the intensity of requests, both from the server and from the clients' side, corresponds to the change of strategies of interacting parties, are presented in Fig. 3.
0.9 pi(t) /0.9 0.81 0.72 0.63 0.54 0.45 0.36 0.27 0.18 t)( P1 ,pi P2 e ttsa P3 an P4 ing P5 ieb P6 foy P7 iitl b a b o eh / 0 0.09 r p T
With the increase of λ12 (to 1751 on Fig. 3) the client-server information system is in a difficult mode of operation, the probability of its being in the state of S1 is Р1=0,294, and the probability of server overload tends to minimize. The probability of transition of the system to the state S2 will be maximal and equal to Р2=0,611 for the given values of intensities from the table for strategy С3. It is possible to reduce the load on this state of the server by increasing its resource by creating a queue of applications between the client and the server by changing the data flow rate by setting the «window size» parameter W, regulating the values of the intensity λ34 и λ41, as well as by confirming the reception of the data flow parts (acknowledgement) by the server by regulating the values of the intensity λ37 и λ56. The diagrams of the probabilities of states versus time for fixed values of event intensities and at λ12=2619 are presented on Fig. 4. If this threshold value (λ12=2619) is exceeded that corresponds to the system state in which the server has received the maximum number of requests, which it can process without overfilling the clipboard or reducing the quality of request servicing, the process of exhausting the system resource due to unfinished connections occurs.
/0.9 t) P1 (i ,p P2 e tta P3 s a P4 n i g P5 n ieb P6 fo P7 y t i l i b a b o r p eh / 0 T 0.9 0.81 0.72 0.63 0.54 0.45 0.36 0.27 0.18 0.09 pi(t)
The scientific novelty of the model consists in the application of the mathematical apparatus of the Markov random processes theory and the solution of Kolmogorov equations for the study and solution of the problem of dynamic management of the resource potential of the client-server information system due to the management of network connection parameters.
The practical importance lies in finding the probabilistic and temporal characteristics describing the states of the process of functioning of the client-server information system at various strategies of establishment and maintenance of parameters of connections by interacting parties.