基于TCP协议的网络数据流实时替换框架及实现-通信与信息系统专业论文.docxVIP

文件接收方不易察觉接收的文件已被替换。最后，本文主要针对如何支持 多个 TCP 连接实时替换进行讨论，从而设计了核心数据结构——TCP 表，以 及当达到表内支持最大连接数时淘汰表内节点的策略和方法。 本文在提出实时替换框架的同时，还给出了一个 Linux 平台上的具体实 现，并实现了一个轻量级的控制服务端，以便于攻击者可以在远端和控制 端通信，获得更大的灵活性。在文章最后，本文从防御的角度提出几点对 于实时替换的预防和识别方法。 关键词：TCP，实时替换，替换策略，序列号/确认号，PE 文件格式 Real-Time Modification Of Network Data Packets Based On TCP: Framework And Implementation ABSTRACT Now the rapid development of computer network has great influence on peoples daily life, and at the same time, the replacement of network data packets becomes a general attack method. The thesis first gives a definition of the real-time modification of data packets as well as points out its specialty comparing with other replacement methods. Since the modification makes the TCP status of the two communication sides disorder and thus negatively affects the normal interaction, we should take it into consideration. And we should also take action so that the replacement can be hidden from others. The first part of the thesis is a relatively detail introduction of TCP/IP stack, for the huge amount of discussion is based on it. And then, we raised four methods to go into the normal communication and forward the network data packets, which is the basis and the prerequisite of the real-time modification. And then the thesis raised a whole framework of replacement. we pointed out the strategies of transmit layer and the relative problems that the introduction of each strategy brought. So we rectified and improved the strategy to solve the problem in a higher level. And then, we raised some strategies of modification in application layer based on the transmit layer polices discussed before. Another important point is how to hidden the action of replacement from the two sides of normal communication, including how to keep the icon and the length of exe file. And last, we designed a core data structure, TCP table, to maintain multi-session modification of data packets. We also discuss the cache strategy of TCP table node. The thesi