Network Security & Traffic Analysis

网络安全与流量分析

目的

让 Claude 能够协助执行网络安全运维，包括分析 PCAP 文件中的流量、编写 Snort 和 Suricata 的 IDS/IPS 规则、审计防火墙规则、检测网络异常，以及审查网络架构安全性。

---

激活条件

当用户询问以下内容时，此技能会激活：

• 分析 PCAP 或 PCAPNG 文件中的可疑活动
• 创建 Snort 或 Suricata 检测规则
• 编写用于网络分析的 Zeek（Bro）脚本
• 审查防火墙规则（iptables、nftables、pf、云安全组）
• 检测网络流量中的 C2 信标通信、DNS 隧道或数据外传
• 网络架构安全审查
• IDS/IPS 特征规则开发
• 网络分段和东西向流量分析
• TLS 检查和证书分析

---

前提条件

pip install scapy dpkt requests

推荐工具：

• Wireshark / tshark — 抓包和 GUI 分析
• Suricata — 新一代 IDS/IPS 引擎
• Snort 3 — 经典 IDS/IPS 引擎
• Zeek (Bro) — 网络分析和脚本框架
• tcpdump — 命令行抓包
• NetworkMiner — PCAP 取证产物提取
• nmap — 网络扫描和发现

---

核心能力

1. PCAP 流量分析

当用户提供 PCAP 文件或要求分析网络流量时：

# Quick summary with tshark
tshark -r capture.pcap -q -z io,phs           # Protocol hierarchy
tshark -r capture.pcap -q -z conv,tcp         # TCP conversations
tshark -r capture.pcap -q -z endpoints,ip     # IP endpoints

# Extract HTTP requests
tshark -r capture.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri

# Extract DNS queries
tshark -r capture.pcap -Y dns.flags.response==0 -T fields -e ip.src -e dns.qry.name

# Extract files
tshark -r capture.pcap --export-objects http,./extracted_files/
tshark -r capture.pcap --export-objects smb,./smb_files/

# Run automated analysis
python scripts/pcap_analyzer.py --file capture.pcap --output analysis.json
python scripts/pcap_analyzer.py --file traffic.pcapng --dns --http --top-talkers 20

流量分析检查清单：

[ ] Protocol distribution — any unexpected protocols?
[ ] Top talkers — unusual source/destination combinations
[ ] DNS analysis — DGA domains, unusually long queries, high volume
[ ] HTTP analysis — suspicious user agents, unusual methods, encoded data
[ ] TLS analysis — invalid certificates, unusual SNI, cert fingerprints
[ ] ICMP analysis — large payloads (tunneling), ping sweeps
[ ] SMB analysis — authentication attempts, file access patterns
[ ] Data volume — large uploads (exfiltration?), irregular transfer sizes
[ ] Timing analysis — regular interval beaconing patterns

信标通信检测： 信标通信表现为出站连接之间存在一致的时间间隔：

# tshark: extract connection timestamps to check for regularity
tshark -r capture.pcap -Y "ip.dst == 203.0.113.10 and tcp.flags.syn==1" \
  -T fields -e frame.time_epoch | \
  awk 'NR>1{printf "%.0f\n", ($1-prev)} {prev=$1}' | sort | uniq -c | sort -rn
# Consistent counts at specific intervals = beaconing

DNS 隧道检测：

# Long DNS query names (>50 chars for subdomain) = likely tunneling
tshark -r capture.pcap -Y "dns.qry.name.len > 50" \
  -T fields -e ip.src -e dns.qry.name | head -50

# High-volume DNS to single domain = tunneling
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name | \
  awk -F. '{print $(NF-1)"."$NF}' | sort | uniq -c | sort -rn | head -20

2. 创建 Suricata 规则

当用户要求创建 Suricata IDS 规则时：

Suricata 规则语法参考：

action protocol src_ip src_port -> dst_ip dst_port (options)

规则模板：

# Template: C2 Beaconing over HTTP
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"MALWARE Suspicious C2 Beacon - Regular Interval HTTP POST";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/api/check" endswith;
    http.header; content:"User-Agent: Mozilla/4.0 (compatible)";
    threshold:type both, track by_src, count 5, seconds 300;
    classtype:trojan-activity;
    sid:9000001;
    rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server, attack_target Client_Endpoint,
              created_at 2025_05_28, deployment Perimeter;
)

# Template: DNS Tunneling Detection
alert dns $HOME_NET any -> any any (
    msg:"POLICY Possible DNS Tunneling - Long Subdomain Query";
    dns.query;
    content:".";
    byte_test:1,>,50,0,relative;  # Query length > 50 chars
    threshold:type both, track by_src, count 20, seconds 60;
    classtype:policy-violation;
    sid:9000002;
    rev:1;
)

# Template: Lateral Movement via SMB
alert smb $HOME_NET any -> $HOME_NET 445 (
    msg:"LATERAL-MOVEMENT PsExec Lateral Movement Detected";
    flow:established,to_server;
    content:"PSEXESVC";
    nocase;
    classtype:trojan-activity;
    sid:9000003;
    rev:1;
)

# Template: Data Exfiltration - Large Upload
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"EXFILTRATION Possible Data Exfiltration - Large HTTP POST";
    flow:established,to_server;
    http.method; content:"POST";
    http.request_body; content:!"";
    dsize:>1000000;   # > 1MB body
    threshold:type both, track by_src, count 3, seconds 300;
    classtype:policy-violation;
    sid:9000004;
    rev:1;
)

# Template: Malicious TLS Certificate (self-signed with suspicious CN)
alert tls $EXTERNAL_NET any -> $HOME_NET any (
    msg:"MALWARE Suspicious TLS Certificate - Self-Signed C2";
    tls.cert_subject; content:"CN=localhost";
    tls.cert_issuer; content:"CN=localhost";
    classtype:trojan-activity;
    sid:9000005;
    rev:1;
)

# Template: Web Shell Access
alert http $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"WEBSHELL Possible Web Shell Access";
    flow:established,to_server;
    http.uri; content:".php";
    http.request_body; content:"cmd="; nocase;
    content:"exec"; nocase; distance:0;
    classtype:web-application-attack;
    sid:9000006;
    rev:1;
)

Suricata 测试：

# Test rules against PCAP (offline)
suricata -r capture.pcap -S custom.rules -l ./logs/

# Test rule syntax
suricata --dump-config

# Check for rule performance issues
suricata -r test.pcap -S rules.rules --runmode single 2>&1 | grep "perf"

3. 创建 Snort 3 规则

# Snort 3 format — note different syntax from Snort 2
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (
    msg:"WEB-ATTACK SQL Injection Attempt";
    flow:established,to_server;
    http_uri;
    content:"' OR '1'='1";
    nocase;
    sid:9001001;
    rev:1;
    classtype:web-application-attack;
)

4. Zeek 脚本模板

# Detect connections with unusually regular intervals (beaconing)
module BeaconDetect;

export {
    redef enum Log::ID += { LOG };
    type Info: record {
        ts: time &log;
        src: addr &log;
        dst: addr &log;
        interval: interval &log;
    };
}

global connection_times: table[addr, addr] of vector of time;

event connection_established(c: connection) {
    local key = [c$id$orig_h, c$id$resp_h];
    if (key !in connection_times)
        connection_times[key] = vector();
    connection_times[key] += network_time();
}

event connection_state_remove(c: connection) {
    local key = [c$id$orig_h, c$id$resp_h];
    if (key in connection_times && |connection_times[key]| > 5) {
        # Calculate intervals and check for regularity
        # Flag if standard deviation < 5% of mean
    }
}

5. 防火墙配置审计

当用户提供防火墙规则或要求进行审计时：

iptables 审查检查清单：

# View current rules
iptables -L -n -v --line-numbers
iptables -L INPUT -n -v --line-numbers
iptables -L OUTPUT -n -v --line-numbers

# Check for dangerous rules:
iptables -L | grep "ACCEPT"  # List all ACCEPT rules
iptables -L | grep "0.0.0.0"  # Any-source rules

iptables 安全检查清单：

[ ] Default policy is DROP (not ACCEPT) for all chains
[ ] INPUT chain: only established/related + specific allowed services
[ ] OUTPUT chain: restrict to necessary outbound (optional but best practice)
[ ] FORWARD chain: DROP by default unless this is a router
[ ] Management access (SSH/22) restricted to specific source IPs
[ ] No rules accepting from 0.0.0.0/0 to ALL ports
[ ] Logging enabled for DROPPED packets
[ ] Anti-spoofing rules for RFC 1918 addresses on external interfaces
[ ] ICMP restricted (allow echo-reply/time-exceeded, block ping from internet)
[ ] Port 0 blocked (often used in scans)

AWS 安全组审计：

Rules that should NEVER exist in production:
✗ Inbound: 0.0.0.0/0 → Port 22 (SSH open to internet)
✗ Inbound: 0.0.0.0/0 → Port 3389 (RDP open to internet)
✗ Inbound: 0.0.0.0/0 → Port 0-65535 (any port from internet)
✗ Outbound: 0.0.0.0/0 → Port 0-65535 (unrestricted outbound)

Rules that are acceptable:
✓ Inbound: 0.0.0.0/0 → Port 443 (HTTPS for public web service)
✓ Inbound: 10.0.0.0/8 → Port 22 (SSH from internal VPC only)
✓ Inbound: [known IP] → Port 22 (SSH from jump box)

防火墙审计报告模板：

## Firewall Audit Report — [Device/Platform]

**Risk Summary:**
| Severity | Count |
|----------|-------|
| Critical | 2 |
| High | 5 |
| Medium | 8 |

**CRITICAL: SSH exposed to internet**
- Rule: `iptables -A INPUT -p tcp --dport 22 -j ACCEPT`
- Risk: Exposed to brute-force and CVE exploitation
- Fix: `iptables -A INPUT -p tcp --dport 22 -s [admin_ip] -j ACCEPT`

**HIGH: No default deny policy**
- Current: `-P INPUT ACCEPT`
- Fix: `-P INPUT DROP` + explicit allow rules

6. 网络架构安全审查

当用户描述或提供网络架构时：

审查框架：

Zone Model (most to least trusted):
  Internal (Core) → DMZ → Internet

Checkpoints:
[ ] Clear network zones with enforced boundaries
[ ] DMZ properly isolated from internal network
[ ] No direct internet-to-internal traffic allowed
[ ] East-west traffic controls between internal zones (microsegmentation)
[ ] Management network isolated from production
[ ] Out-of-band management for network devices
[ ] VPN gateway in DMZ, not directly on internal segment
[ ] DNS resolvers not exposed to internet
[ ] Log aggregation on separate isolated segment

---

脚本参考

pcap_analyzer.py

python scripts/pcap_analyzer.py --file capture.pcap --output analysis.json
python scripts/pcap_analyzer.py --file traffic.pcapng --dns --http --top-talkers 20
python scripts/pcap_analyzer.py --file capture.pcap --detect-beaconing --output beacons.json

---

技能集成

条件	相邻技能
侦察中发现的服务	← 技能 01（侦察与 OSINT）
用于威胁关联的网络 IOC	→ 技能 06（威胁狩猎）
用于 IR 时间线的网络证据	→ 技能 07（事件响应）
自动化告警响应	→ 技能 11（CSOC 自动化）

---

参考资料

• Suricata 文档
• Snort 3 规则编写指南
• Wireshark 用户指南
• Zeek 文档
• SANS 网络取证
• TCP/IP 指南

---

v3.0 增强（2026 更新）

加密流量时代的分析：

• JA4+ 指纹识别 — 采用 JA4/JA4S/JA4H/JA4X 套件（JA3 的后继方案），无需解密即可通过 TLS 对客户端、服务端和恶意软件进行指纹识别；在 Zeek/Suricata 中以此为线索进行调查。
• QUIC / HTTP3 — 解析 QUIC（UDP/443）；注意，传统的以 TCP 为中心的规则会漏掉这类流量。在可见时检查 Initial 数据包和 SNI。
• 加密 DNS — 检测 DoH/DoT/DoQ 的使用和隧道传输；建立解析器基线，并标记可疑端点。
• 改进信标检测 — 采用考虑抖动的间隔分析、字节数规律性分析和长连接评分（RITA 风格），以发现通过 HTTPS/QUIC 进行的 C2 通信。
• Zeek 优先的处理管线 — 生成 conn、ssl、http、dns、x509 和 JA4 日志作为分析基础；针对 Zeek notices 编写检测规则。

精确性规则： 报告流量时应包含 5 元组、JA4 指纹、字节数/持续时间，以及带置信度评分的判定；在适用时同时提供 Suricata 规则和 Zeek 检测。